Tools / Bulk HTTP Security Headers Checker & Grade (with change alerts)

Bulk HTTP Security Headers Checker & Grade (with change alerts)

Check many sites' HTTP security headers and get an A+ to F grade. Input: urls. Output (JSON/CSV): one row per item with url, finalUrl, statusCode, grade, score, missingHeaders, warnings, httpsRedirect, hsts, csp.

Run it on Apify Store →

What it's for

Client security/compliance reports (agencies, MSPs)
Catch header regressions after deploys or CDN changes
Vendor/prospect security posture screening

Example input

{
 "urls": [
  "https://apify.com",
  "therealtour360.com",
  "https://github.com",
  "no-such-domain-zq81x.com"
 ],
 "monitorMode": true
}

Example output

{
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "redirects": 0,
  "score": 83,
  "grade": "A",
  "missingHeaders": [
    "Permissions-Policy"
  ],
  "warnings": [
    "Cookies missing Secure/HttpOnly/SameSite: _octo"
  ],
  "httpsRedirect": true,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "csp": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/asse…",
  "server": "github.com",
  "headers": {
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/asse…",
    "x-frame-options": "deny",
    "x-content-type-options": "nosniff",
    "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "server": "github.com"
  },
  "cookiesChecked": 3,
  "checkedAt": "2026-10-12T02:03:57.842Z",
  "changes": null,
  "isChanged": false
}

Input reference

Field	Type	Notes
`urls` required	array	URLs or domains
`maxConcurrency`	integer	Concurrency
`monitorMode`	boolean	Remember grades/headers; later runs flag changes.
`onlyChanged`	boolean	In monitor mode, output only changed sites.
`stateStoreName`	string	State store name

Pricing

Pay per event: Site checked $0.001, Headers changed (monitor) $0.005. Plus Apify's small per-run start fee. Apify's free plan includes monthly credit to try it.

How to run

Open the Store page and click Try for free.
Fill in the input (or paste the example JSON in the JSON tab).
Click Start, then export results as CSV, Excel or JSON, or call it via the Apify API.
Optional: add a Schedule and a webhook/Slack/email integration for ongoing monitoring.

Open Bulk HTTP Security Headers Checker & Grade (with change alerts) on Apify →