Pricing

Rating

Developer

Actor stats

Categories

Share

HSTS Header Checker

Checks the Strict-Transport-Security (HSTS) response header for a list of URLs.

It flags common problems such as:

• Missing HSTS on HTTPS responses
• Invalid header syntax (missing/invalid max-age)
• max-age too low (configurable)
• max-age=0 (disables HSTS)
• preload present but preload requirements not met

Input

• startUrls (required): URLs to check (Request List Sources format)
• requestStrategy: HEAD_THEN_GET (default), HEAD_ONLY, GET_ONLY
• followRedirects, maxRedirects
• minMaxAgeSeconds: warn if max-age is below this value
• requireIncludeSubDomains, requirePreload

Output

Dataset (per-URL)

Each item includes (among others):

• startUrl, finalUrl, statusCode, usedMethod, timingMs
• strictTransportSecurityRaw, maxAge, includeSubDomains, preload
• score, ok, warningCount, errorCount, issues

Key-value store

• SUMMARY (JSON)
• REPORT (JSON)

Example input

{
"startUrls":[
{"url":"https://example.com"},
{"url":"http://example.com"}
],
"maxUrls":2,
"timeoutSecs":20,
"requestStrategy":"HEAD_THEN_GET",
"followRedirects":true,
"maxRedirects":10,
"minMaxAgeSeconds":15552000,
"requireIncludeSubDomains":false,
"requirePreload":false,
"maxConcurrency":5,
"proxyConfiguration":{"useApifyProxy":false}
}

Quick start

Store page: https://apify.com/scrappy_garden/hsts-header-checker

Paste this into Input and click Run:

{
"startUrls":[
{
"url":"https://example.com/"
}
],
"proxyConfiguration":{
"useApifyProxy":false
}
}

Outputs (what you get)

• Dataset: Dataset items typically include fields like: startUrl, finalUrl, statusCode, strictTransportSecurityRaw, maxAge, includeSubDomains, preload, score, ok, warningCount.
• Key-value store: REPORT, SUMMARY

Tips (trust + predictable results)

• Start with 1–3 URLs to validate behavior, then scale up.
• If a target blocks requests, enable Proxy and/or slow down concurrency in Input.
• Use the SUMMARY / REPORT keys (when present) for automation pipelines and monitoring.

Related actors

• security-headers-checker (https://apify.com/scrappy_garden/security-headers-checker)
• cache-control-checker (https://apify.com/scrappy_garden/cache-control-checker)
• content-type-header-validator (https://apify.com/scrappy_garden/content-type-header-validator)
• x-frame-options-header-checker (https://apify.com/scrappy_garden/x-frame-options-header-checker)

Search keywords

hsts header checker, hsts header checker - strict-transport-security audit, website audit, seo, http headers