$1 per result

Security Headers Checker

Check HTTP security headers on any website. Grades CSP, HSTS, X-Frame-Options, X-Content-Type-Options and more, with fix guidance for every gap.

Run it on Apify All tools

Who it is for

Anyone who needs a defensible answer about HTTP security headers across more than one site.

What you would use it for

• Grade CSP, HSTS, X-Frame-Options and X-Content-Type-Options with fix guidance per header.
• Check an estate of domains in one run rather than pasting them into a web form one at a time.
• Produce evidence for a security questionnaire or client report.
• Re-run after a change to confirm the header actually shipped.

What you get back

One JSON record per page checked. These are the actual fields returned by the most recent successful run — read from the live catalogue, not a documented ideal.

Sample output

Trimmed from a real run.

{
  "actor": "artifact-machine-security-headers-checker",
  "actorVersion": "0.1.0",
  "checkedAt": "2026-07-29T05:04:13.890Z",
  "url": "https://neighbornest.kids/",
  "score": 22,
  "grade": "F",
  "headerCounts": {
    "A": 0,
    "B": 1,
    "C": 1,
    "D": 2,
    "F": 3
  },
  "headers": [
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=63072000",
      "grade": "B",
      "note": "Good max-age (730d) — add includeSubDomains, and `preload`",
      "description": "Enforces HTTPS connections",
      "weight": 15
    },
    {
      "name": "Content-Security-Policy",
      "value": null,

Pricing

$1 per result. Pay-per-event through Apify — no subscription, and a run that returns nothing costs nothing.

Calling it from code

Any HTTP client works. Replace <TOKEN> with your Apify API token.

curl -X POST "https://api.apify.com/v2/acts/artifact-machine~artifact-machine-security-headers-checker/run-sync-get-dataset-items?token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":[{"url":"https://example.com"}]}'

Questions

How is this different from a free online header checker?

For one URL, it is not — free scanners are good and you should use them. This exists for the case they do not serve: a list of domains, checked programmatically, returning JSON you can store, diff and re-run on a schedule.

Other tools

Schema Audit - JSON-LD Structured Data Validator · Sitemap Health Audit - XML Sitemap Validator · Tech Stack Analyzer - Detect Website Technologies · AI Access Audit

Details read from the live Apify catalogue on 2026-07-29.