Pricing

Rating

Developer

Actor stats

Categories

Share

Security Headers Checker

Audit common HTTP security headers for one or more URLs.

This Actor fetches response headers (HEAD-first with GET fallback) and reports missing/weak settings for:

• Content-Security-Policy (CSP)
• Strict-Transport-Security (HSTS)
• X-Frame-Options / CSP frame-ancestors
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy (COOP)
• Cross-Origin-Embedder-Policy (COEP)
• Cross-Origin-Resource-Policy (CORP)
• X-Permitted-Cross-Domain-Policies

Input

• Start URLs: list of URLs to check
• Follow redirects: evaluate headers on the final URL (recommended)
• Use HEAD request first: faster, falls back to GET when servers do not support HEAD
• Check Set-Cookie flags (basic): optional basic cookie security checks
• Warn on Server / X-Powered-By: optional fingerprinting warnings

Output

Dataset (per URL)

Each item includes startUrl, finalUrl, statusCode, securityScore, issues, and the checked header values.

Key-value store

• SUMMARY: totals + header presence counts
• REPORT: SUMMARY plus top issues across all checked URLs

Notes

• Security headers are context-dependent. Treat findings as an audit checklist, not an absolute pass/fail.
• Some sites set headers only on specific paths (e.g., app routes). Include representative URLs.

Quick start

Store page: https://apify.com/scrappy_garden/security-headers-checker

Paste this into Input and click Run:

{
"startUrls":[
{
"url":"https://example.com/"
}
],
"proxyConfiguration":{
"useApifyProxy":false
}
}

Outputs (what you get)

• Dataset: Dataset items typically include fields like: startUrl, finalUrl, statusCode, redirected, securityScore, warningCount, errorCount, issues, checkedAt.
• Key-value store: REPORT, SUMMARY

Tips (trust + predictable results)

• Start with 1–3 URLs to validate behavior, then scale up.
• If a target blocks requests, enable Proxy and/or slow down concurrency in Input.
• Use the SUMMARY / REPORT keys (when present) for automation pipelines and monitoring.

Related actors

• hsts-header-checker (https://apify.com/scrappy_garden/hsts-header-checker)
• cache-control-checker (https://apify.com/scrappy_garden/cache-control-checker)
• content-type-header-validator (https://apify.com/scrappy_garden/content-type-header-validator)
• x-frame-options-header-checker (https://apify.com/scrappy_garden/x-frame-options-header-checker)

Search keywords

security headers checker, security headers checker - audit csp, hsts, xfo and more, website audit, seo, http headers