Pricing

Rating

Developer

Actor stats

Categories

Share

Security Headers Analyzer

Audit HTTP security headers against OWASP best practices across hundreds of URLs in a single run. Missing headers like HSTS, CSP, and X-Frame-Options are the most common findings in penetration tests — yet most teams only discover them after an incident. Scan your entire domain inventory in minutes with automatic grading from A to F.

Features

• OWASP header checks — validates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and COEP
• Automatic grading — assigns a score (0-100) and letter grade (A-F) based on header coverage and configuration quality
• Actionable warnings — flags weak configurations like unsafe-inline in CSP or missing max-age in HSTS
• Bulk processing — scan hundreds of URLs concurrently in a single run
• Redirect-aware — optionally follows redirects and reports the full redirect chain
• Flexible HTTP method — use HEAD for speed or GET for servers that block HEAD requests

Input

Input Example

{
"urls":[
"https://google.com",
"https://github.com",
"https://example.com"
],
"method":"HEAD",
"followRedirects":true,
"concurrency":10
}

Output

Each URL produces one dataset record containing the security grade, score, list of missing and misconfigured headers, and all response headers for reference.

Key output fields:

• inputUrl (string) — the URL as submitted
• finalUrl (string) — the URL after redirects (if followed)
• status (number) — HTTP status code
• grade (string) — letter grade from A (excellent) to F (critical gaps)
• score (number) — numeric score from 0 to 100
• missing (array) — list of required headers that are absent
• warnings (array) — list of configuration issues found
• headers (object) — all response headers (lower-cased keys)
• redirects (array) — redirect chain traversed
• checkedAt (string) — ISO 8601 timestamp

Output Example

{
"inputUrl":"https://github.com",
"finalUrl":"https://github.com/",
"status":200,
"grade":"B",
"score":80,
"missing":[
"Referrer-Policy"
],
"warnings":[
"Missing Permissions-Policy.",
"Missing Cross-Origin-Opener-Policy (COOP).",
"Missing Cross-Origin-Resource-Policy (CORP).",
"Missing Cross-Origin-Embedder-Policy (COEP)."
],
"headers":{
"strict-transport-security":"max-age=31536000; includeSubdomains; preload",
"content-security-policy":"default-src 'none'; base-uri 'self'; ...",
"x-frame-options":"deny",
"x-content-type-options":"nosniff"
},
"redirects":["https://github.com/"],
"checkedAt":"2026-03-09T12:00:00.000Z"
}

Pricing

Pay only for URLs successfully scanned. Respects your per-run spending limit.

Use Cases

• Penetration test prep — pre-scan client domains to identify missing security headers before a full engagement
• Compliance audits — verify OWASP header requirements across all production endpoints for SOC 2 or ISO 27001
• DevOps CI/CD checks — schedule regular scans to catch header regressions after deployments
• Agency security reports — generate client-ready security grades for website portfolios
• M&A due diligence — quickly assess the security posture of acquisition targets

Related Actors