# Bulk HTTP Security Headers Analyzer - CSP, HSTS (`logiover/bulk-http-security-headers`) Actor
Analyze HTTP security headers for thousands of URLs. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Returns pass/fail per header plus a numeric security score. No API key, export to CSV/JSON. Ideal for security audits and compliance scanning.
- **URL**: https://apify.com/logiover/bulk-http-security-headers.md
- **Developed by:** [Logiover](https://apify.com/logiover) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 3 total users, 2 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet
## Pricing
from $3.50 / 1,000 results
This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.
Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event
## What's an Apify Actor?
Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".
## How to integrate an Actor?
If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.
- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).
For usage examples, see the [API](#api) section below.
For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).
# README
## Bulk HTTP Security Headers Analyzer 🛡️ — CSP, HSTS, Score & Grade (No API key)
    
***
**Audit HTTP security headers for thousands of URLs in one run.** This **bulk security header scanner** checks every URL for **Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy** and more. Each check is weighted and scored, totaled into a **0–100 security score**, and mapped to a letter grade from **A+ to F**. Paste a list of URLs and the Actor fetches their headers in parallel via **HTTP HEAD** — fast, lightweight, no page body downloaded. **No API key, no login.**
> ### 🏆 Why this security header scanner?
>
> **30+ fields per URL** · **thousands of URLs per run** · 11 weighted checks + A+–F grade · HEAD-only (no page body) · export to JSON / CSV / Excel. The unofficial **HTTP security header checker API** for security audits, compliance scanning and bug-bounty recon.
> Looking for a **security header checker**, a **CSP auditor**, an **HSTS scanner**, a **bulk HTTP security audit tool**, or a **free HTTP security analyzer API**? This Actor does all the checks at scale.
***
### ✨ What this Actor does / Key features
- 🛡️ **11 security header checks** — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP, plus `Server` and `X-Powered-By` information-leak checks.
- 🎯 **Numeric score (0–100)** — each check is weighted by security importance; get a total score and a letter grade (A+ to F).
- 📋 **Pass / fail per header** — every header gets its own boolean pass/fail column plus the raw header value.
- 🧩 **HSTS deep parse** — `max-age`, `includeSubDomains` and `preload` flags extracted into separate fields.
- 🚨 **Missing headers list** — a comma-separated list of exactly which recommended security headers are absent.
- 🔍 **Information-leak checks** — flags when `Server` and `X-Powered-By` headers expose stack details.
- ↪️ **Redirect-aware** — follows up to 5 redirects and reports the `finalUrl` (so `http://` → `https://` is handled transparently).
- ⚡ **HEAD-only, no body** — HTTP HEAD is fast; all security headers live in the response headers.
- 🔑 **No API key** — works out of the box with standard HTTP requests; proxy support built in.
### 🚀 Quick start (3 steps)
1. **Configure** — paste your list of URLs into **URLs to Analyze**, one per line (`https://` is added automatically if missing). Adjust **Max Concurrency** for large lists.
2. **Run** — click **Start**. The Actor fetches headers from every URL in parallel and scores each one.
3. **Get your data** — open the **Output** tab and export to **JSON, CSV, Excel or XML**, or pull it via the Apify API.
### 📥 Input
Give the Actor a `urls` list. Everything else is optional.
#### Example — audit a portfolio of sites
```json
{
"urls": ["https://github.com/", "https://stackoverflow.com/", "https://example.com/"],
"maxConcurrency": 20,
"proxyConfiguration": { "useApifyProxy": true }
}
```
#### Example — large list, higher concurrency
```json
{
"urls": ["https://site1.com/", "https://site2.com/", "https://site3.com/", "https://site4.com/"],
"maxConcurrency": 50,
"proxyConfiguration": { "useApifyProxy": true }
}
```
| Field | Type | Description |
|-------|------|-------------|
| `urls` | array | **Required.** URLs to scan for security headers, one per line. HTTP and HTTPS both supported; the scheme is added automatically if missing. |
| `maxConcurrency` | integer | How many URLs to scan in parallel. Higher is faster. Default `20`, max `100`. |
| `proxyConfiguration` | object | Proxy used for the HTTP requests (recommended to avoid rate limiting). Default: Apify Proxy (datacenter). |
> **Tip:** HTTPS-only URLs produce the most meaningful results — plain HTTP sites won't return HSTS. Feed the output of a crawler or sitemap extractor into `urls` to audit an entire domain at once.
### 📤 Output
One row per URL — a full security-header report with **30+ fields**, exportable to JSON, CSV, Excel or XML. Here is a trimmed sample record:
```json
{
"url": "https://github.com/",
"finalUrl": "https://github.com/",
"statusCode": "200",
"securityScore": "78",
"grade": "B",
"cspHeader": "default-src 'none'; ...",
"cspPass": "true",
"hstsHeader": "max-age=31536000; includeSubdomains; preload",
"hstsPass": "true",
"hstsMaxAge": "31536000",
"hstsIncludeSubdomains": "true",
"hstsPreload": "true",
"xFrameOptions": "deny",
"xFrameOptionsPass": "true",
"xContentTypeOptions": "nosniff",
"xContentTypeOptionsPass": "true",
"referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
"referrerPolicyPass": "true",
"permissionsPolicy": "not set",
"permissionsPolicyPass": "false",
"crossOriginOpenerPolicy": "not set",
"crossOriginOpenerPolicyPass": "false",
"server": "GitHub.com",
"xPoweredBy": "not set",
"missingHeaders": "Permissions-Policy, Cross-Origin-Opener-Policy",
"passCount": "8",
"totalChecks": "11",
"checkedAt": "2026-07-06T12:00:00.000Z"
}
```
📋 Full field reference (click to expand)
| Field | Description |
|-------|-------------|
| `url` | The analyzed URL |
| `finalUrl` | Final URL after any redirects |
| `statusCode` | HTTP status code |
| `securityScore` | Overall score from 0 (no headers) to 100 (all recommended headers well-configured) |
| `grade` | Letter grade: A+, A, B, C, D, F |
| `cspHeader` | Content-Security-Policy value or `not set` |
| `cspPass` | `true` if CSP is present and well-formed |
| `cspReportOnly` | Content-Security-Policy-Report-Only value if present |
| `hstsHeader` | Strict-Transport-Security value or `not set` |
| `hstsPass` | `true` if HSTS is present with max-age ≥ 1 year |
| `hstsMaxAge` | HSTS max-age value in seconds |
| `hstsIncludeSubdomains` | `true`/`false` — whether `includeSubDomains` is present |
| `hstsPreload` | `true`/`false` — whether the `preload` directive is present |
| `xFrameOptions` | X-Frame-Options value or `not set` |
| `xFrameOptionsPass` | `true` if set to DENY or SAMEORIGIN |
| `xContentTypeOptions` | X-Content-Type-Options value or `not set` |
| `xContentTypeOptionsPass` | `true` if set to `nosniff` |
| `referrerPolicy` | Referrer-Policy value or `not set` |
| `referrerPolicyPass` | `true` if a privacy-preserving policy is set |
| `permissionsPolicy` | Permissions-Policy value or `not set` |
| `permissionsPolicyPass` | `true` if Permissions-Policy is present |
| `crossOriginOpenerPolicy` | COOP value or `not set` |
| `crossOriginOpenerPolicyPass` | `true` if set to same-origin |
| `crossOriginResourcePolicy` | CORP value or `not set` |
| `crossOriginEmbedderPolicy` | COEP value or `not set` |
| `server` | Server header value — flagged if present (information leak) |
| `xPoweredBy` | X-Powered-By header value — flagged if present (information leak) |
| `cacheControl` | Cache-Control value |
| `missingHeaders` | Comma-separated recommended headers that are absent |
| `passCount` | Number of checks passed |
| `totalChecks` | Total number of checks performed (11) |
| `latencyMs` | Time taken for the HTTP request in milliseconds |
| `checkedAt` | ISO 8601 timestamp |
### 💡 Use cases
- **Security posture audits** — scan your entire web portfolio and get a numeric score per URL; track improvement over time.
- **Compliance scanning** — check for missing HSTS, CSP and other headers referenced by SOC 2, ISO 27001 and PCI DSS controls.
- **Vendor risk assessment** — score third-party SaaS tools and partners on their HTTP security hygiene.
- **Bug-bounty recon** — identify sites with weak or missing security headers that broaden attack surface.
- **DevSecOps CI/CD** — run as a gate check after deployments to catch regressions in security header configuration.
- **Competitor benchmarking** — compare your security header posture against competitors on the same 0–100 scale.
### 👥 Who uses it
Security engineers & pentesters · bug-bounty hunters · DevSecOps & platform teams · compliance & GRC analysts · SaaS vendor-risk teams · agencies auditing client sites.
### 💰 Pricing
This Actor runs on a simple **pay-per-result** model — you pay for the URL reports you extract, with no separate Apify platform fees to calculate. Try it on the **free tier** first, then scale up. See the **Pricing** tab on this page for the current rate.
### 🔍 How it works
For each URL, the Actor sends an **HTTP HEAD request** (with automatic redirect following) and extracts every security-relevant header from the response. Each header is checked against a best-practice definition:
- **CSP** — must be present and well-formed (length > 10 chars). Weight: 20.
- **HSTS** — must have `max-age` ≥ 31,536,000 (1 year). Weight: 15.
- **X-Frame-Options** — must be `DENY` or `SAMEORIGIN`. Weight: 12.
- **X-Content-Type-Options** — must equal `nosniff`. Weight: 10.
- **Referrer-Policy** — must restrict referrer data. Weight: 10.
- **Permissions-Policy** — must be present. Weight: 8.
- **COOP / CORP / COEP** — cross-origin isolation headers. Weight: 5 each.
- **Server / X-Powered-By** — information leak: points awarded if NOT present. Weight: 5 each.
Scores are weighted and normalized to 0–100, then mapped to a letter grade (**A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30**). The `missingHeaders` field lists every recommended header that's absent, so you know exactly what to fix.
### 🧰 Tips & best practices
- HTTPS-only URLs produce more meaningful results — plain HTTP sites won't return HSTS.
- Filter by `grade: "F"` to prioritize the worst offenders first, or sort by `securityScore` descending for a leaderboard.
- Schedule recurring weekly runs and diff datasets to track security header improvements over time.
- Parse the `missingHeaders` field to generate prioritized remediation tickets per URL.
- Use `maxConcurrency: 20`+ for large lists and keep Apify Proxy enabled.
### ❓ Frequently Asked Questions
#### How do I check security headers for many URLs at once?
Paste your full URL list into the **URLs to Analyze** field and run the Actor once. It fetches headers from every URL in parallel via HTTP HEAD and returns one row per URL with pass/fail for each of the 11 checks, a score and a grade.
#### Which security headers are checked?
CSP, HSTS (with `max-age` ≥ 1 yr), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy, plus `Server` and `X-Powered-By` information-leak checks.
#### Is there a free HTTP security header checker API?
Yes — this Actor works as an on-demand HTTP security header checker API with no API key of its own. Trigger it and pull results via the Apify API, so you can wire security-header scoring into your own tooling or CI pipeline.
#### Can I scan security headers without an API key or login?
Yes. The Actor needs no account, cookies or API key on the target sites — it sends standard HTTP HEAD requests. You only need an Apify account to run it.
#### How is the security score calculated?
Each header check carries a weight based on its security impact (CSP=20, HSTS=15, X-Frame-Options=12, and so on). The score is the weighted percentage of checks that pass, normalized to 0–100. Grade: A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30.
#### Can I export security header audits to CSV or JSON?
Yes — every URL is one row with dedicated columns for each header and its pass/fail status, so the dataset drops straight into a spreadsheet or BI tool. Export as CSV, JSON, Excel or XML from the run page or the Apify API.
#### Does it follow redirects?
Yes — the Actor follows up to 5 redirects automatically and reports the final URL in the `finalUrl` field, so `http://example.com` → `https://example.com` redirects are handled transparently.
#### What is a good HTTP security header score?
The Actor grades each URL from A+ to F on a 0–100 scale; anything below a C usually means missing CSP, HSTS or X-Frame-Options headers you should add.
#### How much data can I get?
You can scan thousands of URLs in a single run. Raise `maxConcurrency` (up to 100) for large lists, and feed URLs from a sitemap or crawler to audit an entire domain at once.
#### Is it legal to scan security headers?
Reading a site's HTTP response headers is a standard, lightweight request that downloads no page content. This Actor only inspects publicly returned headers; you are responsible for scanning within applicable terms and laws, and for using the results responsibly.
### 🔗 More web-infra & security tools by logiover
Pair the security header analyzer with the rest of the bulk web-infrastructure and recon suite:
| Actor | What it does |
|---|---|
| [Bulk SSL Certificate Checker](https://apify.com/logiover/bulk-ssl-certificate-checker) | SSL/TLS cert expiry, issuer, SANs, TLS versions & chain validation |
| [Bulk DNS Records Lookup](https://apify.com/logiover/bulk-dns-records-lookup) | A, AAAA, MX, TXT, NS, CNAME, SOA, CAA for thousands of domains |
| [Bulk WHOIS / RDAP Lookup](https://apify.com/logiover/bulk-whois-rdap-lookup) | Domain registration, registrar, dates & nameservers in bulk |
| [Bulk URL Status Checker](https://apify.com/logiover/bulk-url-status-checker) | HTTP status codes, broken links & redirects for large URL lists |
| [Bulk URL Unshortener](https://apify.com/logiover/bulk-url-unshortener) | Expand shortened links and trace full redirect chains |
| [Bulk Website Screenshot Capture](https://apify.com/logiover/bulk-website-screenshot-capture) | Full-page screenshots for many URLs at once |
| [Subdomain Finder](https://apify.com/logiover/subdomain-finder) | Enumerate subdomains for a domain — attack-surface recon |
| [Certificate Transparency Monitor](https://apify.com/logiover/certificate-transparency-monitor) | Monitor CT logs for newly issued certificates |
| [Website Tech Stack Detector](https://apify.com/logiover/website-tech-stack-detector) | Detect frameworks, CMS, analytics & server tech |
| [Website SEO Audit Crawler](https://apify.com/logiover/website-seo-audit-crawler) | On-page SEO analysis across a whole site |
| [Sitemap to URL Crawler](https://apify.com/logiover/sitemap-to-url-crawler) | Expand sitemaps into a clean, dedup'd URL list to feed this scanner |
👉 Browse all **[logiover scrapers on Apify Store](https://apify.com/logiover)** — 180+ actors across real estate, jobs, crypto, social media & B2B data.
### ⏰ Scheduling & integration
Schedule this Actor on Apify to re-scan your web portfolio daily or weekly and track security-header posture over time. Export results to JSON, CSV or Excel, sync to Google Sheets, or push to your database, SIEM, BI tools and webhooks through the Apify API. Connect it to **Make, n8n or Zapier** to alert on new `grade: "F"` URLs or feed remediation tickets into Jira.
### ⭐ Support & feedback
Found a bug or need an extra header check? Open an issue on the **Issues** tab — response is usually fast. If this Actor saves you time, a **★★★★★ review** on the Store page genuinely helps and is hugely appreciated. 🙏
### ⚖️ Legal
This Actor inspects only publicly returned HTTP response headers and downloads no page content. It is intended for legitimate security auditing, compliance and research use. You are responsible for scanning within the target sites' terms of service and any applicable local laws, and for handling results responsibly.
***
### 📝 Changelog
#### 2026-08-01
- Completed the August 2026 full health check: verified empty/programmatic default, Console UI default, and two source-informed alternative inputs on Apify.
- Confirmed successful live execution, non-empty structured output, dataset-field/type integrity, and logical sample quality within the 5-minute quality window.
- Fixed the run Output link from `{{links.apiDefaultDatasetUrl}}` to `{{links.apiDefaultDatasetUrl}}/items` so the results table opens the dataset items endpoint.
#### 2026-08-01 — Health-check remediation
- August 2026 monthly health-check remediation is in progress; this build contains fixes verified from empty/default, Console-default, targeted live probes, or field-level semantic review.
- Fixed the run Output link from `{{links.apiDefaultDatasetUrl}}` to `{{links.apiDefaultDatasetUrl}}/items` so the results table opens the dataset items endpoint.
- The final four-input matrix verdict will be appended after post-build cloud revalidation.
#### 2026-07-06
- ✨ README overhaul: badge/hero/callout structure, richer output sample, ready-to-run example scenarios, web-infra & security cross-promo links, expanded FAQ and clearer quick-start.
#### 2026-07-01
- Maintenance pass: re-verified end-to-end on live data and confirmed successful runs within the 5-minute quality window on the default input.
- Sharpened Store metadata (SEO title & description) and expanded the FAQ with high-intent, long-tail questions for easier discovery in Google and Apify Store search.
- Added ready-to-run example tasks that cover common real-world use cases.
#### 2026-06-24
- Initial release — 11 security header checks with weighted scoring, A+ to F grading, no API key, CSV/JSON export.
***
\*Maintained: last verified 2026-09-01 — checked end-to-end against live run history (reliability, output fields and types, and time/memory budgets).
# Actor input Schema
## `urls` (type: `array`):
List of URLs to scan for security headers. Paste one per line — HTTPS and HTTP both supported. Schemes are added automatically if missing. Leave EMPTY to scan a built-in set of well-known sites.
## `maxResults` (type: `integer`):
Maximum number of URLs to scan in this run. Keeps empty/large inputs fast and cheap. Raise it to process more.
## `sortBy` (type: `string`):
Order of the output rows.
## `maxConcurrency` (type: `integer`):
How many URLs to scan in parallel. Higher is faster.
## `proxyConfiguration` (type: `object`):
Proxy used for the HTTP requests. Recommended to avoid rate limiting.
## Actor input object example
```json
{
"urls": [
"https://github.com/",
"https://google.com/",
"https://example.com/"
],
"maxResults": 1000,
"sortBy": "input",
"maxConcurrency": 20,
"proxyConfiguration": {
"useApifyProxy": true
}
}
```
# Actor output Schema
## `results` (type: `string`):
The dataset containing one row per URL with pass/fail for 11 security headers, a numeric score and letter grade.
# API
You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.
## JavaScript example
```javascript
import { ApifyClient } from 'apify-client';
// Initialize the ApifyClient with your Apify API token
// Replace the '' with your token
const client = new ApifyClient({
token: '',
});
// Prepare Actor input
const input = {
"urls": [
"https://github.com/",
"https://google.com/",
"https://example.com/"
]
};
// Run the Actor and wait for it to finish
const run = await client.actor("logiover/bulk-http-security-headers").call(input);
// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
console.dir(item);
});
// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs
```
## Python example
```python
from apify_client import ApifyClient
# Initialize the ApifyClient with your Apify API token
# Replace '' with your token.
client = ApifyClient("")
# Prepare the Actor input
run_input = { "urls": [
"https://github.com/",
"https://google.com/",
"https://example.com/",
] }
# Run the Actor and wait for it to finish
run = client.actor("logiover/bulk-http-security-headers").call(run_input=run_input)
# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
print(item)
# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start
```
## CLI example
```bash
echo '{
"urls": [
"https://github.com/",
"https://google.com/",
"https://example.com/"
]
}' |
apify call logiover/bulk-http-security-headers --silent --output-dataset
```
## MCP server setup
```json
{
"mcpServers": {
"apify": {
"type": "http",
"url": "https://mcp.apify.com/?tools=fetch-actor-details,logiover/bulk-http-security-headers"
}
}
}
```
The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).
## OpenAPI specification
Download the OpenAPI definition: https://api.apify.com/v2/actors/ko6SoOWpBlnD7sDxE/builds/ev2zF8ENBtg5FZWnO/openapi.json