# 🛡️ Security Headers Checker (`taroyamada/security-headers-checker`) Actor

Audit HTTP security headers in bulk across hundreds of websites. Extract OWASP compliance grades and detect missing HSTS or CSP directives instantly.

- **URL**: https://apify.com/taroyamada/security-headers-checker.md
- **Developed by:** [naoki anzai](https://apify.com/taroyamada) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $7.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Security Headers Checker API | OWASP Audit

Audit HTTP responses across hundreds of target websites instantly using this high-performance security headers checker. Engineering and DevSecOps teams rely on this solution to extract critical security header data and automatically assess their web infrastructure against strict OWASP guidelines. Instead of relying on manual browser checks or building custom scrapers, you can schedule weekly bulk audits to continuously monitor your corporate portfolio for server configuration regressions. By feeding it a list of URLs, the auditor visits each website, analyzes the HTTP headers, and grades every response on a precise 0-100 scale. It assigns a clear A-F score while pinpointing critical missing directives such as HSTS, Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options. Security researchers utilize these structured JSON results to track compliance score changes over time and integrate alerts directly into CI/CD pipelines to warn developers immediately when a new vulnerability is introduced into the environment. Whether you are aiming to improve site trust for SEO or enforcing strict pipeline compliance, every run outputs exact fix recommendations, the overall security grade, and a complete breakdown of successful and failed header checks. Run the tool to scrape compliance details and export data seamlessly.

### Store Quickstart

- Start with `store-input.example.json` to validate grading and output shape on three known URLs.
- If that matches your workflow, switch to `store-input.templates.json` and pick one of:
  - `Quickstart (Dataset)` for a cheap first run
  - `Batch Audit` for broader site portfolios
  - `Weekly Compliance Monitor` for recurring audits with snapshots
  - `Webhook Alert` for automated compliance notifications

### Key Features

- 🛡️ **10 OWASP headers checked** — HSTS, CSP, X-Frame-Options, Referrer-Policy, and more
- 📊 **Security scoring** — 0-100 with A-F grade per site
- 💡 **Fix recommendations** — Exact header values to add (e.g., `Strict-Transport-Security: max-age=31536000`)
- 🔄 **Change tracking** — Detects grade/score changes between runs
- 📋 **Bulk processing** — Check up to 200 URLs per run
- 🪝 **Webhook + CI/CD** — Use in security pipelines

### Use Cases

| Who | Why |
|-----|-----|
| Developers | Automate recurring data fetches without building custom scrapers |
| Data teams | Pipe structured output into analytics warehouses |
| Ops teams | Monitor changes via webhook alerts |
| Product managers | Track competitor/market signals without engineering time |

### Input

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| urls | array | prefilled | List of URLs to audit security headers for. Maximum 200 per run. |
| followRedirects | boolean | `true` | Follow HTTP redirects and check the final URL's headers. |
| delivery | string | `"dataset"` | How to deliver results. 'dataset' saves to Apify Dataset (recommended), 'webhook' sends to a URL. |
| webhookUrl | string | — | Webhook URL to send results to (only used when delivery is 'webhook'). Works with Slack, Discord, or any HTTP endpoint. |
| snapshotKey | string | `"security-headers-snapshots"` | Key name for storing snapshots (used for change detection between runs). |
| concurrency | integer | `5` | Maximum number of parallel requests. Higher = faster but may trigger rate limits. |
| dryRun | boolean | `false` | If true, runs without saving results or sending webhooks. Useful for testing. |

#### Input Example

```json
{
  "urls": ["https://google.com/", "https://github.com/", "https://example.com/"],
  "followRedirects": true,
  "concurrency": 5
}
```

### Input Examples

#### Example: Single URL grade

```json
{
  "urls": [
    "https://example.com/"
  ]
}
```

#### Example: Bulk site audit

```json
{
  "urls": [
    "https://example.com/",
    "https://example.org/"
  ],
  "includeFullHeaders": true
}
```

#### Example: Specific header focus

```json
{
  "urls": [
    "https://example.com/"
  ],
  "headersOfInterest": [
    "Content-Security-Policy",
    "Strict-Transport-Security"
  ]
}
```

### Output

| Field | Type | Description |
|-------|------|-------------|
| `meta` | object |  |
| `results` | array |  |
| `results[].url` | string (url) |  |
| `results[].finalUrl` | string (url) |  |
| `results[].statusCode` | number |  |
| `results[].headers` | object |  |
| `results[].score` | object |  |
| `results[].changes` | array |  |
| `results[].error` | null |  |
| `results[].checkedAt` | timestamp |  |

#### Output Example

```json
{
  "url": "https://github.com/",
  "score": { "total": 75, "grade": "B" },
  "statusCode": 200,
  "headers": {
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "x-frame-options": "deny",
    "x-content-type-options": "nosniff"
  },
  "score": {
    "total": 75,
    "grade": "B",
    "details": [
      { "header": "strict-transport-security", "status": "pass", "points": 20 },
      { "header": "content-security-policy", "status": "missing", "points": 0, "note": "Missing. Add a Content-Security-Policy header" }
    ]
  }
}
```

### API Usage

Run this actor programmatically using the Apify API. Replace `YOUR_API_TOKEN` with your token from [Apify Console → Settings → Integrations](https://console.apify.com/account/integrations).

#### cURL

```bash
curl -X POST "https://api.apify.com/v2/acts/taroyamada~security-headers-checker/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "urls": ["https://google.com/", "https://github.com/", "https://example.com/"], "followRedirects": true, "concurrency": 5 }'
```

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("taroyamada/security-headers-checker").call(run_input={
  "urls": ["https://google.com/", "https://github.com/", "https://example.com/"],
  "followRedirects": true,
  "concurrency": 5
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)
```

#### JavaScript / Node.js

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });
const run = await client.actor('taroyamada/security-headers-checker').call({
  "urls": ["https://google.com/", "https://github.com/", "https://example.com/"],
  "followRedirects": true,
  "concurrency": 5
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
```

### Security cluster — Adjacent actors

Most defensive-security audits cover multiple layers on the same domains. The actors below pair naturally with this one:

- [dns-dmarc-security-checker](https://apify.com/taroyamada/dns-dmarc-security-checker) — Email-layer audit (DMARC / SPF / DKIM / MX) on the same domains.
- [ssl-certificate-monitor](https://apify.com/taroyamada/ssl-certificate-monitor) — TLS-layer audit (cert + chain + expiry) on the same hosts.
- [dns-propagation-checker](https://apify.com/taroyamada/dns-propagation-checker) — Verify DNS-level changes propagated globally before re-auditing HTTP layer.

### Tips & Limitations

- Schedule weekly runs against your production domains to catch config drift.
- Use webhook delivery to pipe findings into your SIEM (Splunk, Datadog, Elastic).
- For CI integration, block releases on `critical` severity findings using exit codes.
- Combine with `ssl-certificate-monitor` for layered cert + headers coverage.
- Findings include links to official remediation docs — share with dev teams via the webhook payload.

### FAQ

**Is running this against a third-party site legal?**

Passive public-header scanning is generally permitted, but follow your own compliance policies. Only scan sites you have authorization for.

**How often should I scan?**

Weekly for production domains; daily if you have high config-change velocity.

**Can I export to a compliance tool?**

Use webhook delivery or Dataset API — formats map well to Drata, Vanta, OneTrust import templates.

**Is this a penetration test?**

No — this actor performs passive compliance scanning only. No exploitation, fuzzing, or auth bypass.

**Does this qualify as a SOC2 control?**

This actor produces evidence artifacts suitable for SOC2 CC7.1 (continuous monitoring). It is not itself a SOC2 certification.

### Related Actors

Security & Compliance cluster — explore related Apify tools:

- [Privacy & Cookie Compliance Scanner | GDPR / CCPA Banner Audit](https://apify.com/taroyamada/privacy-cookie-compliance-scanner) — Scan public privacy pages and cookie banners for GDPR/CCPA compliance signals.
- [SSL Certificate Monitor API | Expiry + Issuer Changes](https://apify.com/taroyamada/ssl-certificate-monitor) — Check SSL/TLS certificates in bulk, detect expiry and issuer changes, and emit alert-ready rows for ops and SEO teams.
- [DNS / SPF / DKIM / DMARC Audit API](https://apify.com/taroyamada/dns-dmarc-security-checker) — Bulk-audit domains for SPF, DKIM, DMARC, MX, and email-auth posture with grades and fix-ready recommendations.
- [robots.txt AI Policy Monitor | GPTBot ClaudeBot](https://apify.com/taroyamada/robotstxt-ai-checker) — Detect GPTBot, ClaudeBot, Google-Extended, and other AI crawler policies in robots.
- [Data Breach Disclosure Monitor | HIPAA Breach Watch](https://apify.com/taroyamada/data-breach-disclosure-monitor) — Monitor the HHS OCR Breach Portal for new HIPAA data breach disclosures.
- [WCAG Accessibility Checker API | ADA & EAA Compliance Audit](https://apify.com/taroyamada/wcag-accessibility-checker) — Audit websites for WCAG 2.
- [📜 Open-Source License & Dependency Audit API](https://apify.com/taroyamada/open-source-license-dependency-audit) — Audit npm packages for license risk, dependency depth, maintainer activity, and compliance posture.
- [Trust Center & Subprocessor Monitor API](https://apify.com/taroyamada/trust-center-subprocessor-monitor) — Monitor vendor trust centers, subprocessor lists, DPA updates, and security posture changes.

### Cost

**Pay Per Event**:

- `actor-start`: $0.01 (flat fee per run)
- `dataset-item`: $0.003 per output item

**Example**: 1,000 items = $0.01 + (1,000 × $0.003) = **$3.01**

No subscription required — you only pay for what you use.

### ⭐ Was this helpful?

If this actor saved you time, please [**leave a ★ rating**](https://apify.com/taroyamada/security-headers-checker/reviews) on Apify Store. It takes 10 seconds, helps other developers discover it, and keeps updates free.

Bug report or feature request? Open an issue on the [Issues tab](https://apify.com/taroyamada/security-headers-checker/issues) of this actor.

# Actor input Schema

## `urls` (type: `array`):

List of URLs to audit security headers for. Maximum 200 per run.

## `followRedirects` (type: `boolean`):

Follow HTTP redirects and check the final URL's headers.

## `delivery` (type: `string`):

How to deliver results. 'dataset' saves to Apify Dataset (recommended), 'webhook' sends to a URL.

## `webhookUrl` (type: `string`):

Webhook URL to send results to (only used when delivery is 'webhook'). Works with Slack, Discord, or any HTTP endpoint.

## `snapshotKey` (type: `string`):

Key name for storing snapshots (used for change detection between runs).

## `concurrency` (type: `integer`):

Maximum number of parallel requests. Higher = faster but may trigger rate limits.

## `dryRun` (type: `boolean`):

If true, runs without saving results or sending webhooks. Useful for testing.

## Actor input object example

```json
{
  "urls": [
    "https://google.com/",
    "https://github.com/",
    "https://example.com/"
  ],
  "followRedirects": true,
  "delivery": "dataset",
  "snapshotKey": "security-headers-snapshots",
  "concurrency": 5,
  "dryRun": false
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://google.com/",
        "https://github.com/",
        "https://example.com/"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("taroyamada/security-headers-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://google.com/",
        "https://github.com/",
        "https://example.com/",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("taroyamada/security-headers-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://google.com/",
    "https://github.com/",
    "https://example.com/"
  ]
}' |
apify call taroyamada/security-headers-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,taroyamada/security-headers-checker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Nwaae0aBGZqISN6Rm/builds/QXmF5xIpGHw2gW4Z6/openapi.json