Security Headers Checker

hipersoft/security-headers-checker

Check and grade the HTTP security headers of any website in bulk: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Returns an A+..F grade and the missing headers. For security and SEO audits. One row per site as JSON, CSV or Excel.

Run this scraper →See the API call

Total users

Monthly users

Total runs

Per site checked

$0.0005

Last rebuilt

Oct 28, 2026

Overview

Check and grade the HTTP security headers of any website in bulk with the Security Headers Checker. Paste a list of sites and get each one's grade, the value of every key security header, and a list of what's missing — exported as JSON, CSV or Excel.

Built for security audits, SEO and site-quality reviews, compliance checks and monitoring, it turns a list of URLs into a clear security-header scorecard.

What it does

🛡️ Grades each site — an A+ to F grade based on the key security headers present.
🔎 Per-header detail — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy values.
❌ Missing list — exactly which recommended headers are absent.
🔐 Extras — HTTPS status, server banner, Secure cookie flag, legacy X-XSS-Protection and X-Powered-By.
⚡ Bulk & fast — check many sites in parallel with a per-site timeout.
📤 Export anywhere — JSON, CSV or Excel, or straight into a dashboard or report.

Example output

{
  "url": "https://github.com",
  "status": 200,
  "grade": "A",
  "score": 5,
  "https": true,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "contentSecurityPolicy": "default-src 'none'; ...",
  "xFrameOptions": "deny",
  "missing": ["permissions-policy"]
}

How to use it

Paste a list of website URLs (or bare domains).
Tune concurrency and the per-site timeout if needed.
Run, and download the scorecard as JSON, CSV or Excel.

Input fields

Field	Description
Website URLs	Full URLs or bare domains (checked over HTTPS).
Concurrency	Sites to check at once (1–20).
Per-site timeout (seconds)	How long to wait before marking a timeout.
Max sites	Maximum sites to check (0 = no limit).

Output fields

url, ok, status, finalUrl, server, https, grade, score, missing, hsts, contentSecurityPolicy, xFrameOptions, xContentTypeOptions, referrerPolicy, permissionsPolicy, xXssProtection, setCookieSecure, poweredBy.

Popular use cases

Security audits — score a portfolio of sites and flag weak configurations.
SEO & site quality — headers are part of a healthy, trustworthy site.
Compliance — evidence which security headers are (or aren't) in place.
Monitoring — schedule runs and catch regressions when headers change.
Agencies — produce client-ready security-header reports at scale.

FAQ

Do I need an account or key? No. Paste your URLs and run.

How is the grade calculated? From the presence of six recommended security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) — more present means a higher grade.

Can I check bare domains? Yes — bare domains are checked over HTTPS automatically.

Can I export to Excel or Google Sheets? Yes — results download as JSON, CSV or Excel and integrate with Sheets, dashboards and reports.

Bulk website security-header grading — HSTS, CSP, X-Frame-Options and more — clean and export-ready for security and SEO audits.

Input

Field	Type	Description
`urls` Website URLs	array	Sites to check — full URLs or bare domains (e.g. 'github.com', 'https://example.com'). Bare domains are checked over HTTPS.
`concurrency` Concurrency	integer	How many sites to check in parallel (1–20). Default: `8`
`requestTimeoutSecs` Per-site timeout (seconds)	integer	How long to wait for each site before marking it as a timeout. Default: `20`
`maxItems` Max sites	integer	Maximum number of sites to check (0 = no limit). Default: `0`

API

curl -X POST "https://api.apify.com/v2/acts/hipersoft~security-headers-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "urls": [
    "github.com",
    "example.com"
  ]
}'

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("hipersoft/security-headers-checker").call(run_input={
    "urls": [
        "github.com",
        "example.com"
    ]
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('hipersoft/security-headers-checker').call({
  "urls": [
    "github.com",
    "example.com"
  ]
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Pricing

Event	Price	Paid plans from
Site checked Charged for each website checked.	$0.0005	$0.0003

You pay only for what the run returns. Set a maximum cost per run and it stops cleanly at that limit.

Related scrapers

Bulk Image Downloader

Download thousands of images from a list of URLs and store each in the key-value store with a public link. Returns content type, size, dimensions and SHA-256 per image. Bulk-ready. Great for datasets, backups and media pipelines.

8,102 runs · 103 users · $0.056 / url processed

Text to Speech

Convert any text to natural-sounding speech as an MP3 download. 300+ premium neural voices across 70+ languages, adjustable rate, pitch and volume. Great for voiceovers, videos, accessibility and audio content. No setup.

278 runs · 22 users · $0.01 / audio generated

Google Maps Email Extractor

Search Google Maps for businesses, then crawl each business website to extract emails, social profiles and extra phone numbers. Turns any Maps search into a ready lead list. No setup.

159 runs · 8 users · $0.006 / business lead scraped

Website Screenshot

Capture full-page or viewport screenshots of any URL as PNG or JPEG, at any device size. For monitoring, previews, thumbnails and automation workflows.

156 runs · 3 users · $0.004 / screenshot captured

Bulk URL Status Checker

Check thousands of URLs over plain HTTP: status codes, broken links (404/410/5xx), full redirect chains, response time, content type, page title and SSL certificate expiry.

154 runs · 13 users · $0.002 / url checked

Google Search Scraper

Scrape Google Search results (organic listings) for any query: title, URL, displayed URL, snippet and position. Multi-query, per-country/language, pagination. Uses Google SERP proxy — reliable, no captcha, no setup.

121 runs · 8 users · $0.001 / result scraped

Need a source that isn't here?

Send the site and the fields. We build it and you get it first.

Request a build