# HTTP Headers Inspector - Full Headers + Security Grade (`eliai/http-headers-inspector`) Actor

Fetch every HTTP response header of any URL, plus a security-header analysis (HSTS, CSP, X-Frame-Options) with an A-F grade and server fingerprint. Single or bulk. $0.0004 per URL, cheaper than every paid headers actor measured; failed fetches are free.

- **URL**: https://apify.com/eliai/http-headers-inspector.md
- **Developed by:** [Broke to Built](https://apify.com/eliai) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.32 / 1,000 checked urls

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## HTTP Headers Inspector - full headers + security grade + server fingerprint

Fetch **every** HTTP response header of any URL, then get a security-header analysis (HSTS, CSP,
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with an A-F grade
and a server fingerprint. Single URL or bulk. Built for security reviews, SEO/tech audits,
uptime checks, and agent tool-calls.

**$0.0004 per URL checked - cheaper than every paid headers/security-header actor measured on the
Store.** Failed fetches are recorded free.

### What you get

- **Every response header** captured into a clean JSON object.
- **Security grade (A-F)** from which hardening headers are present vs missing.
- **Server fingerprint** - `Server`, `X-Powered-By`, `Via`.
- **Status, redirect detection, response timing (ms)**.
- **Single or bulk** - one `url` or many `urls`, capped by `maxUrls` (1-50).
- **Fail-soft**: an unreachable URL returns `{ok:false, error}` and is **never charged**.

### Input

```json
{ "url": "https://github.com/", "urls": ["https://example.com/"], "method": "GET", "maxUrls": 25 }
```

### Output (real run, 2026-08-07)

```json
{
  "ok": true,
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "redirected": true,
  "status": 200,
  "method": "GET",
  "timingMs": 80,
  "headers": { "content-encoding": "gzip", "strict-transport-security": "max-age=31536000; includeSubdomains; preload", "content-security-policy": "default-src 'none'; ...", "x-frame-options": "deny", "x-content-type-options": "nosniff" },
  "security": { "present": ["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy"], "missing": ["permissions-policy"], "grade": "B" },
  "server": { "server": "GitHub.com", "poweredBy": null, "via": null }
}
```

An unreachable host comes back uncharged: `{ "url": "https://bad.invalid/", "ok": false, "error": "fetch failed" }`

### Pricing - $0.0004 per URL, no start fee

Charged once per URL successfully inspected; failed fetches are free. Prices below checked via the
Apify Store API on 2026-08-07:

| Actor | Pricing | Per URL |
|---|---|---|
| **This actor** | **$0.0004 per URL** | **$0.0004** |
| bgfc97/http-security-headers-audit | $0.0005 per url-audited | $0.0005 |
| andok/security-headers-analyzer | $0.001 per dataset item | $0.001 |
| pink\_comic/security-headers-checker | $0.0001 start + $0.002 per item | $0.002 |

### Limits (honest ones)

- Follows redirects and reports the final response; per-hop headers are not itemized (see our HTTP Status Checker for chains).
- `maxUrls` capped at 50 per run.
- Sites that block non-browser user agents at the CDN may return their block-page headers.
- The security grade reflects header **presence**, not policy strength (a weak CSP still counts as present).

### FAQ

- **Does it show every header or just security ones?** Every response header, plus a separate security section.
- **Can I check many URLs at once?** Yes - pass `urls` (up to 50). Each successful URL is one charge.
- **What happens on a dead URL?** You get an `{ok:false, error}` record and are not charged for it.
- **Can I use HEAD instead of GET?** Yes - set `method` to `HEAD`, `OPTIONS`, etc.
- **Is the grade an official standard?** No - it is a simple present/missing score across six common hardening headers, meant for quick triage.

### When not to use this

- **You need a security posture score you can hand an auditor.** The grade counts how many of six
  hardening headers are present. It says nothing about whether your CSP is any good. Use a dedicated
  CSP evaluator for policy strength.
- **You need the full redirect chain.** Redirects are followed and only the final response is
  reported. For per-hop status codes and headers, use an HTTP status/redirect chain checker.
- **You need TLS certificate details.** Cipher suites, chain, expiry and CT logs are not covered -
  this reads HTTP response headers only.
- **You need what a browser sees after JavaScript.** Headers come from a plain HTTP request; there is
  no headless browser, so headers set by service workers or meta-equivalent CSP tags are not included.
- **The target blocks non-browser clients.** A CDN that challenges the request returns its own block
  page headers, which will look like a badly configured site rather than an error.

### Use from code or AI agents

```bash
curl -X POST "https://api.apify.com/v2/acts/EliAI~http-headers-inspector/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"url":"https://github.com/"}'
```

Callable as an agent tool through the Apify MCP server (`mcp.apify.com`) - add the actor and your
LLM can inspect headers on demand. Every record with `ok:false` is a diagnostic, not a result.

# Actor input Schema

## `url` (type: `string`):

A single URL (or domain) to inspect. If it has no scheme, https:// is assumed.

## `urls` (type: `array`):

Multiple URLs to inspect in one run. Combined with the single URL above.

## `method` (type: `string`):

Request method used to fetch headers.

## `maxUrls` (type: `integer`):

Cap on how many URLs to process (1-50).

## Actor input object example

```json
{
  "url": "https://github.com/",
  "urls": [
    "https://github.com/",
    "https://example.com/"
  ],
  "method": "GET",
  "maxUrls": 25
}
```

# Actor output Schema

## `results` (type: `string`):

Every item this run produced, as JSON.

## `resultsCsv` (type: `string`):

The same items as a spreadsheet-ready CSV.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "url": "https://github.com/",
    "urls": [
        "https://github.com/",
        "https://example.com/"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("eliai/http-headers-inspector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "url": "https://github.com/",
    "urls": [
        "https://github.com/",
        "https://example.com/",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("eliai/http-headers-inspector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "url": "https://github.com/",
  "urls": [
    "https://github.com/",
    "https://example.com/"
  ]
}' |
apify call eliai/http-headers-inspector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,eliai/http-headers-inspector"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/BfOPDNBHgjXueLBt1/builds/4N6gPv5cWHcTywswZ/openapi.json