# HTTP Security Headers & OWASP Posture Auditor (`gp005/security-headers-auditor`) Actor

Audit HTTP security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP) for any URL. Returns a 0-100 grade, letter rating, and a prioritized fix list with exact header values to add. Single polite GET per URL, no crawling.

- **URL**: https://apify.com/gp005/security-headers-auditor.md
- **Developed by:** [Geo](https://apify.com/gp005) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $14.00 / 1,000 url auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## HTTP Security Headers & OWASP Posture Auditor

> A **security headers checker** that audits HTTP response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP) for any URL. Returns a 0–100 grade, a letter rating (A–F), and a prioritized fix list with exact header values to add.

A single polite GET per URL — no crawling, no forms, no auth. Built for **security teams, DevOps, QA, and agencies** who need a fast **http security headers check** across a portfolio of sites.

### What is an HTTP Security Headers Checker?

This actor scans any URL's response headers against OWASP-recommended security controls. Instead of manually inspecting headers or visiting multiple online checkers one site at a time, you submit a list of URLs and get back a scored report with prioritized remediation for each one. Use it programmatically via the Apify API, in CI/CD pipelines, or as a scheduled weekly scan.

### Security Headers Checked

| Header | What it prevents | Severity if missing |
|---|---|---|
| 🔴 **Content-Security-Policy (CSP)** | XSS and data injection — the single most important security header | **Critical** |
| 🔴 **Strict-Transport-Security (HSTS)** | SSL-strip MITM; forces HTTPS (RFC 6797) | **High** |
| 🟠 **X-Frame-Options** | Clickjacking (`DENY` / `SAMEORIGIN`) | **Medium** |
| 🟠 **X-Content-Type-Options** | MIME-sniffing XSS (`nosniff`) | **Medium** |
| 🟡 **Referrer-Policy** | Referrer leakage to third parties | **Low** |
| 🟡 **Permissions-Policy** | Locks down browser features (camera, mic, geo, payment) | **Low** |
| 🟡 **COOP / CORP / COEP** | Cross-origin isolation for Spectre-class security | **Low** |

Each URL gets a **0–100 posture score** (A–F grade), issues sorted by severity with a copy-pasteable **fix** per issue, and a `top_fix` summary.

### Use Cases

- **Security & compliance teams** — scan your asset inventory weekly to catch missing headers and CSP regressions.
- **DevOps / SRE** — verify new deployments ship the full OWASP security header set before they hit production.
- **Agencies & consultants** — generate a prioritized **security headers audit** report per client site in one run.
- **Bug-bounty / recon** — quick **http header analyzer** triage on scoped targets.
- **PCI-DSS / SOC 2** — evidence that security headers are present and correctly configured across your perimeter.

### Input Example

```json
{
  "urls": ["https://example.com/", "https://github.com/"]
}
```

### Output Example (per URL)

```json
{
  "url": "https://example.com/",
  "http_status": 200,
  "posture_score": 45,
  "posture_grade": "F",
  "https_enabled": true,
  "csp": "missing",
  "hsts": "missing",
  "issue_count": 7,
  "top_fix": "Add: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
  "issues": [
    { "severity": "critical", "area": "CSP", "message": "CSP header is missing…", "fix": "Add: Content-Security-Policy…" },
    { "severity": "high", "area": "HSTS", "message": "HSTS header is missing…", "fix": "Add: Strict-Transport-Security…" }
  ]
}
```

### Pricing (Pay-Per-Event)

| Event | Unit | Price |
|---|---|---|
| `actor-start` | per run | $0.01 |
| `url-audited` | per URL fetched and scored | $0.02 |
| `issue-flagged` | per issue flagged (capped at 8 per URL) | $0.01 |

**Example cost:** 100 URLs × average 4 issues each = $0.01 + (100 × $0.02) + (400 × $0.01) = **$6.01** (≈ 6¢ per URL).

### Integration

- **API / SDK** — standard Apify actor; call via HTTP API, JavaScript or Python SDK.
- **Schedule** — run weekly drift detection; get alerts on grade drops.
- **Webhooks** — POST results to Make, n8n, or Zapier on completion.
- **CI/CD** — add to a deploy pipeline; fail the build if posture\_grade drops below B.
- **Bulk** — pass hundreds of URLs; sequential single-request politeness means no rate-limit issues.

### Other Apify Actors

- **[SSL/TLS Certificate Expiry Monitor](https://apify.com/gp005/tls-cert-monitor)** — monitor certificate expiry, detect changes, and get alerts for any HTTPS domain. Pairs naturally with security headers auditing for a full transport-layer security check.
- **[Email Deliverability & Domain Posture Auditor](https://apify.com/gp005/email-deliverability-auditor)** — audit SPF, DKIM, DMARC, MTA-STS, and BIMI for any domain. Complete your email security posture alongside HTTP header checks.

### Frequently Asked Questions

#### What are the most important HTTP security headers?

Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) are the most impactful — CSP is your strongest XSS defense and HSTS prevents SSL-stripping MITM attacks. X-Frame-Options and X-Content-Type-Options are also essential for clickjacking and MIME-sniffing protection. OWASP maintains a [Secure Headers Project](https://owasp.org/www-project-secure-headers/) with a full reference list.

#### How do I check if my website has security headers?

Pass the URL to this actor. It performs a single GET request and inspects all response headers against the OWASP security headers checklist. You get a scored report with exact fixes for every missing or misconfigured header.

#### What is the difference between COOP, CORP, and COEP?

Cross-Origin-Opener-Policy (COOP) isolates top-level windows from cross-origin popups. Cross-Origin-Resource-Policy (CORP) controls who can load your resources cross-origin. Cross-Origin-Embedder-Policy (COEP) requires cross-origin isolation for powerful browser features like `SharedArrayBuffer`. They work together for Spectre-class security.

#### How do I fix missing HSTS?

Add the `Strict-Transport-Security` header to your web server or CDN configuration with a `max-age` of at least one year: `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`. This tells browsers to always connect via HTTPS for the specified duration.

#### What is CSP and why is it critical?

Content-Security-Policy is a browser security mechanism that controls which resources (scripts, styles, images, fonts) a page is allowed to load. A properly configured CSP blocks inline scripts, restricts origins, and is the single most effective defense against cross-site scripting (XSS) attacks. This auditor flags wildcard directives and unsafe patterns (`'unsafe-inline'`, `'unsafe-eval'`).

### Limitations & Honest Notes

- **One page per URL.** The auditor fetches exactly the URL you provide and inspects the response headers. It does not crawl. To audit multiple pages, pass multiple URLs.
- **CDN/WAF headers may differ from origin.** A CDN like Cloudflare may add HSTS at the edge even if your origin does not set it. The audit sees what a real client receives.
- **CSP quality is heuristic.** We detect wildcards, `'unsafe-inline'`, and `'unsafe-eval'`, but a full CSP evaluator (Google CSP Evaluator) is out of scope.
- **No authenticated scanning.** If your app requires login to reach certain headers, this auditor sees only the pre-auth response. Use a custom UA or API-token URL where supported.
- **Public data only.** The audit reads public response headers — safe for any site. An optional ownership-verification meta tag is supported for ToS compliance.

### Data Source

A single polite HTTP GET to each user-supplied URL, using a descriptive user-agent. No scraping of page content, no form submission, no auth. Response headers are the only data extracted.

### Support

Found a bug or have a feature request? Open an issue on the [GitHub repository](https://github.com/gp005/actor-security-headers-auditor) or use the Issues tab on the Apify Store page.

# Actor input Schema

## `urls` (type: `array`):

URLs to audit for HTTP security headers. Ideally your own sites. The auditor issues a single polite GET per URL and inspects response headers — no crawling, no forms, no auth.

## `verifyToken` (type: `string`):

If set, the auditor looks for <meta name="headers-audit-verify" content="TOKEN"> on the page and marks ownership\_verified=true when it matches. Recommended when auditing third-party domains to prove you own them.

## `timeoutSecs` (type: `integer`):

Timeout for each HTTP fetch.

## Actor input object example

```json
{
  "urls": [
    "https://yourbrand.com/",
    "https://app.yourbrand.com/"
  ],
  "timeoutSecs": 15
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://example.com/"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("gp005/security-headers-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": ["https://example.com/"] }

# Run the Actor and wait for it to finish
run = client.actor("gp005/security-headers-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://example.com/"
  ]
}' |
apify call gp005/security-headers-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gp005/security-headers-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/QXiuTQU5o0wQsbU0l/builds/VkbE7yrDcAn7G7QCw/openapi.json