# Http Header Inspector (`zerobreak/http-header-inspector`) Actor

HTTP header inspector that pulls response headers from any URL, scores them for security gaps, and flags missing CSP, HSTS, and X-Frame-Options, so teams can audit caching, redirects, and server config without running curl.

- **URL**: https://apify.com/zerobreak/http-header-inspector.md
- **Developed by:** [ZeroBreak](https://apify.com/zerobreak) (community)
- **Categories:** Developer tools, SEO tools
- **Features:** Limited permissions
- **Stats:** 6 total users, 2 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.99 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## HTTP Header Inspector: Audit HTTP Response Headers for SEO and Security

HTTP Header Inspector fetches response headers from any URL and shows what the server actually sends back. Give it a URL (or a list) and you get every header, a security score based on which recommended headers are missing, and the full redirect chain with status codes at each hop. No curl, no shell scripts, no manual checking.

### Use cases

- **SEO auditing**: check content-type, cache-control, and redirect chains across pages that may be dragging down crawlability or load times
- **Security auditing**: find absent headers like CSP, HSTS, X-Frame-Options, and Referrer-Policy before they show up in a security review
- **Redirect monitoring**: trace redirect chains and catch double redirects or http-to-https loops that eat crawl budget
- **Cache configuration review**: inspect Cache-Control, ETag, and Last-Modified to understand how pages are being cached by browsers and CDNs
- **Server fingerprint checks**: see what server software and version headers are exposed in responses

### What data does this actor extract?

Each URL produces one result:

```json
{
    "inputUrl": "https://apify.com",
    "url": "https://apify.com/",
    "statusCode": 200,
    "statusText": "OK",
    "redirectChain": [],
    "redirectCount": 0,
    "contentType": "text/html; charset=utf-8",
    "server": "nginx",
    "cacheControl": "max-age=3600, public",
    "etag": "\"abc123\"",
    "lastModified": "Mon, 01 Jan 2024 00:00:00 GMT",
    "contentSecurityPolicy": "default-src 'self'",
    "strictTransportSecurity": "max-age=31536000; includeSubDomains",
    "xFrameOptions": "DENY",
    "xContentTypeOptions": "nosniff",
    "referrerPolicy": "strict-origin-when-cross-origin",
    "permissionsPolicy": "camera=(), microphone=()",
    "xXssProtection": "1; mode=block",
    "accessControlAllowOrigin": "",
    "allHeaders": { "content-type": "text/html; charset=utf-8" },
    "securityScore": 80,
    "missingSecurityHeaders": ["cross-origin-opener-policy", "cross-origin-resource-policy"],
    "checkedAt": "2024-06-01T12:00:00+00:00"
}
```

### Input

| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| `url` | string | | Single URL to inspect. |
| `urls` | array | | List of URLs to inspect in batch. |
| `maxUrls` | integer | 100 | Cap on URLs processed per run. |
| `requestTimeoutSecs` | integer | 30 | Per-request timeout in seconds. |
| `timeoutSecs` | integer | 300 | Overall actor timeout in seconds. |
| `proxyConfiguration` | object | Datacenter (Anywhere) | Proxy type and location for requests. Supports Datacenter, Residential, Special, and custom proxies. Optional. |

#### Example input

```json
{
    "urls": ["https://apify.com", "https://apify.com/store"],
    "maxUrls": 50,
    "requestTimeoutSecs": 30,
    "proxyConfiguration": { "useApifyProxy": true }
}
```

### Output

The actor stores one result per URL in a dataset.

| Field | Type | Description |
|-------|------|-------------|
| `inputUrl` | string | Original URL as provided in the input. |
| `url` | string | Final URL after following all redirects. |
| `statusCode` | integer | HTTP status code returned by the server. |
| `statusText` | string | HTTP status phrase (e.g., OK, Not Found). |
| `redirectChain` | array | Each redirect hop, with url and statusCode. |
| `redirectCount` | integer | Number of redirects followed. |
| `contentType` | string | Content-Type header value. |
| `contentEncoding` | string | Content-Encoding header (e.g., gzip). |
| `server` | string | Server header value. |
| `cacheControl` | string | Cache-Control directive. |
| `etag` | string | ETag header value. |
| `lastModified` | string | Last-Modified header value. |
| `contentSecurityPolicy` | string | Content-Security-Policy header. |
| `strictTransportSecurity` | string | Strict-Transport-Security (HSTS) header. |
| `xFrameOptions` | string | X-Frame-Options header. |
| `xContentTypeOptions` | string | X-Content-Type-Options header. |
| `referrerPolicy` | string | Referrer-Policy header. |
| `permissionsPolicy` | string | Permissions-Policy header. |
| `xXssProtection` | string | X-XSS-Protection header. |
| `accessControlAllowOrigin` | string | Access-Control-Allow-Origin (CORS) header. |
| `allHeaders` | object | All response headers as key-value pairs. |
| `securityScore` | integer | Score 0-100: percentage of recommended security headers present. |
| `missingSecurityHeaders` | array | Security headers absent from the response. |
| `checkedAt` | string | ISO 8601 timestamp of when the check ran. |
| `error` | string | Error message if the request failed at the network level. |

### How it works

1. Accepts one URL or a list of URLs as input
2. Sends an HTTP GET request to each URL with a realistic browser User-Agent
3. Follows redirects up to 10 hops, recording each hop's URL and status code
4. Extracts all response headers from the final response
5. Scores the security headers and lists which recommended ones are absent
6. Pushes one result per URL to the dataset

### Integrations

Connect HTTP Header Inspector with other tools using [Apify integrations](https://apify.com/integrations). Export results to Google Sheets, trigger Make or Zapier workflows, or use [webhooks](https://docs.apify.com/integrations/webhooks) to alert your team when runs complete.

### FAQ

**What security headers does the actor check for?**

It checks for: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. The securityScore shows what percentage of these are present.

**Can I check URLs that return 404 or 500 responses?**

Yes. The actor captures headers for any HTTP response, including error codes. Only network-level failures (connection refused, DNS errors, timeouts) produce an error field instead of headers.

**How many URLs can I check per run?**

The default is 100. Raise the limit using the `maxUrls` input, up to 1000.

**Does it follow redirects?**

Yes, up to 10 hops. Each redirect is recorded in `redirectChain` with the URL and status code at that step.

**Can I avoid getting blocked by rate limiting?**

Enable the proxy configuration to route requests through Apify's datacenter or residential proxies. Residential proxies are less likely to be blocked by sites that filter datacenter traffic.

Run it across one page or a batch of hundreds. Results land in a dataset you can export, pipe into Google Sheets, or hook into any workflow that reads from Apify.

# Actor input Schema

## `url` (type: `string`):

Single URL to inspect. Must be a publicly accessible HTTP or HTTPS address.

## `urls` (type: `array`):

List of URLs to inspect in batch. One URL per line. Combined with the single URL field above.

## `maxUrls` (type: `integer`):

Maximum number of URLs to process per run. Caps the batch size to control cost.

## `requestTimeoutSecs` (type: `integer`):

Timeout in seconds for each individual HTTP request. Increase for slow servers.

## `timeoutSecs` (type: `integer`):

Overall timeout for the actor run in seconds. Increase when processing large batches.

## `proxyConfiguration` (type: `object`):

Select proxies to use for requests. Helps avoid IP blocking and rate limits. Datacenter proxies are fastest; Residential proxies are harder to detect.

## Actor input object example

```json
{
  "url": "https://apify.com",
  "urls": [
    "https://apify.com",
    "https://apify.com/store"
  ],
  "maxUrls": 100,
  "requestTimeoutSecs": 30,
  "timeoutSecs": 300,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "url": "https://apify.com",
    "proxyConfiguration": {
        "useApifyProxy": true
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("zerobreak/http-header-inspector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "url": "https://apify.com",
    "proxyConfiguration": { "useApifyProxy": True },
}

# Run the Actor and wait for it to finish
run = client.actor("zerobreak/http-header-inspector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "url": "https://apify.com",
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}' |
apify call zerobreak/http-header-inspector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,zerobreak/http-header-inspector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/TQieGy5qfOaODawlS/builds/LTtEJmStiSqc1Gt1w/openapi.json