What does HTTP Header & Security Analyzer — Check Headers return?

It returns 8 documented output fields: url, httpStatus, securityGrade, securityScore, missingHeaders, server, csp and hsts. Each field declares its type, a description of what it holds, and an example value.

What input does HTTP Header & Security Analyzer — Check Headers require?

urls is required. A further 3 inputs are optional. The full input schema, with types and defaults, is below.

Does HTTP Header & Security Analyzer — Check Headers need an API key or login?

No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.

How do I run HTTP Header & Security Analyzer — Check Headers?

It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.

HTTP Header & Security Analyzer — Check Headers

Analyze HTTP response headers for many URLs — grade security headers (HSTS, CSP, X-Frame-Options, etc.), and report server/tech info, cookies, and Cloudflare. Great for security and SEO audits. No auth.

HTTP Header & Security Analyzer — Check Headers returns 8 documented output fields, including url, httpStatus, securityGrade, securityScore and missingHeaders. Every field carries a declared type, a written description and an example value. 33 runs are recorded on Apify.

Run it on ApifyPay per result · no subscription

8: Output fields
4: Inputs
33: Runs
2026-10-15: Last run

01 — output

What it returns

Every field the extractor writes to its dataset, with its type, a written description and an example value.

Field	Type	What it holds	Example
url	stringnull	The URL this row describes.	https://example.com/pricing
httpStatus	integernull	HTTP status code returned by the request.	200
securityGrade	stringnull	Security expressed as a letter grade.	<securityGrade>
securityScore	stringnull	Security score, from 0 to 100.	<securityScore>
missingHeaders	stringnull	Security headers that are absent.	<missingHeaders>
server	stringnull	Server that answered.	<server>
csp	booleannull	The Content-Security-Policy header value, when present.	true
hsts	stringnull	The Strict-Transport-Security header value, when present.	<hsts>

02 — sample

One record

Assembled from the example values declared on the schema above, not invented at render time.

{
  "url": "https://example.com/pricing",
  "httpStatus": 200,
  "securityGrade": "<securityGrade>",
  "securityScore": "<securityScore>",
  "missingHeaders": "<missingHeaders>",
  "server": "<server>",
  "csp": true,
  "hsts": "<hsts>"
}

03 — input

What you give it

Input	Type	Description
urls	arrayrequired	URLs to analyze.
includeAllHeaders	booleanoptional	Attach the full header map per URL.
useProxy	booleanoptional	For sites that block datacenter IPs.
maxItems	integeroptional	Hard cap.

04 — run

Run HTTP Header & Security Analyzer on your own input

It runs in the cloud on Apify. Nothing to install, and you are billed per result returned rather than per attempt.

Open on Apify ↗

Also in developer tools, automation

05 — questions

Asked before running it

8 of 8 fields described

What does HTTP Header & Security Analyzer — Check Headers return?: It returns 8 documented output fields: url, httpStatus, securityGrade, securityScore, missingHeaders, server, csp and hsts. Each field declares its type, a description of what it holds, and an example value.
What input does HTTP Header & Security Analyzer — Check Headers require?: urls is required. A further 3 inputs are optional. The full input schema, with types and defaults, is below.
Does HTTP Header & Security Analyzer — Check Headers need an API key or login?: No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.
How do I run HTTP Header & Security Analyzer — Check Headers?: It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.