# Bulk HTTP Security Headers Analyzer - CSP, HSTS (`logiover/bulk-http-security-headers`) Actor

Analyze HTTP security headers for thousands of URLs. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Returns pass/fail per header plus a numeric security score. No API key, export to CSV/JSON. Ideal for security audits and compliance scanning.

- **URL**: https://apify.com/logiover/bulk-http-security-headers.md
- **Developed by:** [Logiover](https://apify.com/logiover) (community)
- **Categories:** Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.50 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk HTTP Security Headers Analyzer 🛡️ — CSP, HSTS, Score & Grade (No API key)

![Apify Actor](https://img.shields.io/badge/Apify-Actor-00A67E?logo=apify\&logoColor=white) ![No API key](https://img.shields.io/badge/No%20API%20key-required-2ea44f) ![Pay per result](https://img.shields.io/badge/Pricing-Pay%20per%20result-1C7ED6) ![Security & Web Infra](https://img.shields.io/badge/Category-Security%20%26%20Web%20Infra-6366F1) ![Export](https://img.shields.io/badge/Export-JSON%20%7C%20CSV%20%7C%20Excel-F59E0B)

***

**Audit HTTP security headers for thousands of URLs in one run.** This **bulk security header scanner** checks every URL for **Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy** and more. Each check is weighted and scored, totaled into a **0–100 security score**, and mapped to a letter grade from **A+ to F**. Paste a list of URLs and the Actor fetches their headers in parallel via **HTTP HEAD** — fast, lightweight, no page body downloaded. **No API key, no login.**

> ### 🏆 Why this security header scanner?
>
> **30+ fields per URL** · **thousands of URLs per run** · 11 weighted checks + A+–F grade · HEAD-only (no page body) · export to JSON / CSV / Excel. The unofficial **HTTP security header checker API** for security audits, compliance scanning and bug-bounty recon.

> Looking for a **security header checker**, a **CSP auditor**, an **HSTS scanner**, a **bulk HTTP security audit tool**, or a **free HTTP security analyzer API**? This Actor does all the checks at scale.

***

### ✨ What this Actor does / Key features

- 🛡️ **11 security header checks** — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP, plus `Server` and `X-Powered-By` information-leak checks.
- 🎯 **Numeric score (0–100)** — each check is weighted by security importance; get a total score and a letter grade (A+ to F).
- 📋 **Pass / fail per header** — every header gets its own boolean pass/fail column plus the raw header value.
- 🧩 **HSTS deep parse** — `max-age`, `includeSubDomains` and `preload` flags extracted into separate fields.
- 🚨 **Missing headers list** — a comma-separated list of exactly which recommended security headers are absent.
- 🔍 **Information-leak checks** — flags when `Server` and `X-Powered-By` headers expose stack details.
- ↪️ **Redirect-aware** — follows up to 5 redirects and reports the `finalUrl` (so `http://` → `https://` is handled transparently).
- ⚡ **HEAD-only, no body** — HTTP HEAD is fast; all security headers live in the response headers.
- 🔑 **No API key** — works out of the box with standard HTTP requests; proxy support built in.

### 🚀 Quick start (3 steps)

1. **Configure** — paste your list of URLs into **URLs to Analyze**, one per line (`https://` is added automatically if missing). Adjust **Max Concurrency** for large lists.
2. **Run** — click **Start**. The Actor fetches headers from every URL in parallel and scores each one.
3. **Get your data** — open the **Output** tab and export to **JSON, CSV, Excel or XML**, or pull it via the Apify API.

### 📥 Input

Give the Actor a `urls` list. Everything else is optional.

#### Example — audit a portfolio of sites

```json
{
  "urls": ["https://github.com", "https://stackoverflow.com", "https://example.com"],
  "maxConcurrency": 20,
  "proxyConfiguration": { "useApifyProxy": true }
}
```

#### Example — large list, higher concurrency

```json
{
  "urls": ["https://site1.com", "https://site2.com", "https://site3.com", "https://site4.com"],
  "maxConcurrency": 50,
  "proxyConfiguration": { "useApifyProxy": true }
}
```

| Field | Type | Description |
|-------|------|-------------|
| `urls` | array | **Required.** URLs to scan for security headers, one per line. HTTP and HTTPS both supported; the scheme is added automatically if missing. |
| `maxConcurrency` | integer | How many URLs to scan in parallel. Higher is faster. Default `20`, max `100`. |
| `proxyConfiguration` | object | Proxy used for the HTTP requests (recommended to avoid rate limiting). Default: Apify Proxy (datacenter). |

> **Tip:** HTTPS-only URLs produce the most meaningful results — plain HTTP sites won't return HSTS. Feed the output of a crawler or sitemap extractor into `urls` to audit an entire domain at once.

#### Additional input fields

These optional fields are also available in the input form and API:

| Field | Type | Default | Description |
|---|---|---|---|
| `maxResults` | integer | `1000` | Maximum number of URLs to scan in this run. Keeps empty/large inputs fast and cheap. Raise it to process more. |
| `sortBy` | string | `"input"` | Order of the output rows. |

### 📤 Output

One row per URL — a full security-header report with **30+ fields**, exportable to JSON, CSV, Excel or XML. Here is a trimmed sample record:

```json
{
  "url": "https://github.com",
  "finalUrl": "https://github.com/",
  "statusCode": "200",
  "securityScore": "78",
  "grade": "B",
  "cspHeader": "default-src 'none'; ...",
  "cspPass": "true",
  "hstsHeader": "max-age=31536000; includeSubdomains; preload",
  "hstsPass": "true",
  "hstsMaxAge": "31536000",
  "hstsIncludeSubdomains": "true",
  "hstsPreload": "true",
  "xFrameOptions": "deny",
  "xFrameOptionsPass": "true",
  "xContentTypeOptions": "nosniff",
  "xContentTypeOptionsPass": "true",
  "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
  "referrerPolicyPass": "true",
  "permissionsPolicy": "not set",
  "permissionsPolicyPass": "false",
  "crossOriginOpenerPolicy": "not set",
  "crossOriginOpenerPolicyPass": "false",
  "server": "GitHub.com",
  "xPoweredBy": "not set",
  "missingHeaders": "Permissions-Policy, Cross-Origin-Opener-Policy",
  "passCount": "8",
  "totalChecks": "11",
  "checkedAt": "2026-07-06T12:00:00.000Z"
}
```

<details>
<summary><b>📋 Full field reference (click to expand)</b></summary>

| Field | Description |
|-------|-------------|
| `url` | The analyzed URL |
| `finalUrl` | Final URL after any redirects |
| `statusCode` | HTTP status code |
| `securityScore` | Overall score from 0 (no headers) to 100 (all recommended headers well-configured) |
| `grade` | Letter grade: A+, A, B, C, D, F |
| `cspHeader` | Content-Security-Policy value or `not set` |
| `cspPass` | `true` if CSP is present and well-formed |
| `cspReportOnly` | Content-Security-Policy-Report-Only value if present |
| `hstsHeader` | Strict-Transport-Security value or `not set` |
| `hstsPass` | `true` if HSTS is present with max-age ≥ 1 year |
| `hstsMaxAge` | HSTS max-age value in seconds |
| `hstsIncludeSubdomains` | `true`/`false` — whether `includeSubDomains` is present |
| `hstsPreload` | `true`/`false` — whether the `preload` directive is present |
| `xFrameOptions` | X-Frame-Options value or `not set` |
| `xFrameOptionsPass` | `true` if set to DENY or SAMEORIGIN |
| `xContentTypeOptions` | X-Content-Type-Options value or `not set` |
| `xContentTypeOptionsPass` | `true` if set to `nosniff` |
| `referrerPolicy` | Referrer-Policy value or `not set` |
| `referrerPolicyPass` | `true` if a privacy-preserving policy is set |
| `permissionsPolicy` | Permissions-Policy value or `not set` |
| `permissionsPolicyPass` | `true` if Permissions-Policy is present |
| `crossOriginOpenerPolicy` | COOP value or `not set` |
| `crossOriginOpenerPolicyPass` | `true` if set to same-origin |
| `crossOriginResourcePolicy` | CORP value or `not set` |
| `crossOriginEmbedderPolicy` | COEP value or `not set` |
| `server` | Server header value — flagged if present (information leak) |
| `xPoweredBy` | X-Powered-By header value — flagged if present (information leak) |
| `cacheControl` | Cache-Control value |
| `missingHeaders` | Comma-separated recommended headers that are absent |
| `passCount` | Number of checks passed |
| `totalChecks` | Total number of checks performed (11) |
| `latencyMs` | Time taken for the HTTP request in milliseconds |
| `checkedAt` | ISO 8601 timestamp |

</details>

### 💡 Use cases

- **Security posture audits** — scan your entire web portfolio and get a numeric score per URL; track improvement over time.
- **Compliance scanning** — check for missing HSTS, CSP and other headers referenced by SOC 2, ISO 27001 and PCI DSS controls.
- **Vendor risk assessment** — score third-party SaaS tools and partners on their HTTP security hygiene.
- **Bug-bounty recon** — identify sites with weak or missing security headers that broaden attack surface.
- **DevSecOps CI/CD** — run as a gate check after deployments to catch regressions in security header configuration.
- **Competitor benchmarking** — compare your security header posture against competitors on the same 0–100 scale.

### 👥 Who uses it

Security engineers & pentesters · bug-bounty hunters · DevSecOps & platform teams · compliance & GRC analysts · SaaS vendor-risk teams · agencies auditing client sites.

### 💰 Pricing

This Actor runs on a simple **pay-per-result** model — you pay for the URL reports you extract, with no separate Apify platform fees to calculate. Try it on the **free tier** first, then scale up. See the **Pricing** tab on this page for the current rate.

### 🔍 How it works

For each URL, the Actor sends an **HTTP HEAD request** (with automatic redirect following) and extracts every security-relevant header from the response. Each header is checked against a best-practice definition:

- **CSP** — must be present and well-formed (length > 10 chars). Weight: 20.
- **HSTS** — must have `max-age` ≥ 31,536,000 (1 year). Weight: 15.
- **X-Frame-Options** — must be `DENY` or `SAMEORIGIN`. Weight: 12.
- **X-Content-Type-Options** — must equal `nosniff`. Weight: 10.
- **Referrer-Policy** — must restrict referrer data. Weight: 10.
- **Permissions-Policy** — must be present. Weight: 8.
- **COOP / CORP / COEP** — cross-origin isolation headers. Weight: 5 each.
- **Server / X-Powered-By** — information leak: points awarded if NOT present. Weight: 5 each.

Scores are weighted and normalized to 0–100, then mapped to a letter grade (**A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30**). The `missingHeaders` field lists every recommended header that's absent, so you know exactly what to fix.

### 🧰 Tips & best practices

- HTTPS-only URLs produce more meaningful results — plain HTTP sites won't return HSTS.
- Filter by `grade: "F"` to prioritize the worst offenders first, or sort by `securityScore` descending for a leaderboard.
- Schedule recurring weekly runs and diff datasets to track security header improvements over time.
- Parse the `missingHeaders` field to generate prioritized remediation tickets per URL.
- Use `maxConcurrency: 20`+ for large lists and keep Apify Proxy enabled.

### ❓ Frequently Asked Questions

#### How do I check security headers for many URLs at once?

Paste your full URL list into the **URLs to Analyze** field and run the Actor once. It fetches headers from every URL in parallel via HTTP HEAD and returns one row per URL with pass/fail for each of the 11 checks, a score and a grade.

#### Which security headers are checked?

CSP, HSTS (with `max-age` ≥ 1 yr), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy, plus `Server` and `X-Powered-By` information-leak checks.

#### Is there a free HTTP security header checker API?

Yes — this Actor works as an on-demand HTTP security header checker API with no API key of its own. Trigger it and pull results via the Apify API, so you can wire security-header scoring into your own tooling or CI pipeline.

#### Can I scan security headers without an API key or login?

Yes. The Actor needs no account, cookies or API key on the target sites — it sends standard HTTP HEAD requests. You only need an Apify account to run it.

#### How is the security score calculated?

Each header check carries a weight based on its security impact (CSP=20, HSTS=15, X-Frame-Options=12, and so on). The score is the weighted percentage of checks that pass, normalized to 0–100. Grade: A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30.

#### Can I export security header audits to CSV or JSON?

Yes — every URL is one row with dedicated columns for each header and its pass/fail status, so the dataset drops straight into a spreadsheet or BI tool. Export as CSV, JSON, Excel or XML from the run page or the Apify API.

#### Does it follow redirects?

Yes — the Actor follows up to 5 redirects automatically and reports the final URL in the `finalUrl` field, so `http://example.com` → `https://example.com` redirects are handled transparently.

#### What is a good HTTP security header score?

The Actor grades each URL from A+ to F on a 0–100 scale; anything below a C usually means missing CSP, HSTS or X-Frame-Options headers you should add.

#### How much data can I get?

You can scan thousands of URLs in a single run. Raise `maxConcurrency` (up to 100) for large lists, and feed URLs from a sitemap or crawler to audit an entire domain at once.

#### Is it legal to scan security headers?

Reading a site's HTTP response headers is a standard, lightweight request that downloads no page content. This Actor only inspects publicly returned headers; you are responsible for scanning within applicable terms and laws, and for using the results responsibly.

### 🔗 More web-infra & security tools by logiover

Pair the security header analyzer with the rest of the bulk web-infrastructure and recon suite:

| Actor | What it does |
|---|---|
| [Bulk SSL Certificate Checker](https://apify.com/logiover/bulk-ssl-certificate-checker) | SSL/TLS cert expiry, issuer, SANs, TLS versions & chain validation |
| [Bulk DNS Records Lookup](https://apify.com/logiover/bulk-dns-records-lookup) | A, AAAA, MX, TXT, NS, CNAME, SOA, CAA for thousands of domains |
| [Bulk WHOIS / RDAP Lookup](https://apify.com/logiover/bulk-whois-rdap-lookup) | Domain registration, registrar, dates & nameservers in bulk |
| [Bulk URL Status Checker](https://apify.com/logiover/bulk-url-status-checker) | HTTP status codes, broken links & redirects for large URL lists |
| [Bulk URL Unshortener](https://apify.com/logiover/bulk-url-status-checker) | Expand shortened links and trace full redirect chains |
| [Bulk Website Screenshot Capture](https://apify.com/logiover/bulk-website-screenshot-capture) | Full-page screenshots for many URLs at once |
| [Subdomain Finder](https://apify.com/logiover/subdomain-finder) | Enumerate subdomains for a domain — attack-surface recon |
| [Certificate Transparency Monitor](https://apify.com/logiover/certificate-transparency-monitor) | Monitor CT logs for newly issued certificates |
| [Website Tech Stack Detector](https://apify.com/logiover/website-tech-stack-detector) | Detect frameworks, CMS, analytics & server tech |
| [Website SEO Audit Crawler](https://apify.com/logiover/website-seo-audit-crawler) | On-page SEO analysis across a whole site |
| [Sitemap to URL Crawler](https://apify.com/logiover/sitemap-to-url-crawler) | Expand sitemaps into a clean, dedup'd URL list to feed this scanner |

👉 Browse all **[logiover scrapers on Apify Store](https://apify.com/logiover)** — 180+ actors across real estate, jobs, crypto, social media & B2B data.

### ⏰ Scheduling & integration

Schedule this Actor on Apify to re-scan your web portfolio daily or weekly and track security-header posture over time. Export results to JSON, CSV or Excel, sync to Google Sheets, or push to your database, SIEM, BI tools and webhooks through the Apify API. Connect it to **Make, n8n or Zapier** to alert on new `grade: "F"` URLs or feed remediation tickets into Jira.

### ⭐ Support & feedback

Found a bug or need an extra header check? Open an issue on the **Issues** tab — response is usually fast. If this Actor saves you time, a **★★★★★ review** on the Store page genuinely helps and is hugely appreciated. 🙏

### ⚖️ Legal

This Actor inspects only publicly returned HTTP response headers and downloads no page content. It is intended for legitimate security auditing, compliance and research use. You are responsible for scanning within the target sites' terms of service and any applicable local laws, and for handling results responsibly.

***

This Actor is an independent tool. It is not affiliated with, endorsed by, or sponsored by the website or data publisher it reads from; all trademarks and brand names are the property of their respective owners.

### 📝 Changelog

#### 2026-11-01

- Monthly health check (2026-11-01): a live run on the current build completed successfully and returned data. Input options, output fields and pricing are unchanged.
- README refreshed: 1 link to renamed Actors updated; independence disclaimer added; documented 2 additional input fields.

#### 2026-10-15

- Every request now has a hard time limit, so a proxy connection that stalls can no longer hold up the run or push it past its timeout.
- A run that reaches its maximum cost per run now stops cleanly with its results saved and a status message, instead of ending as aborted.
- A proxy group your account cannot use no longer stops the run at start-up; it falls back to the default Apify Proxy.
- Runs with a short timeout (API and AI-agent calls) now finish inside it with what they collected, instead of being cut off.
- Memory is managed within the run's own limit, which removes a rare out-of-memory crash on large pages.

#### 2026-09-23

- Fleet-wide quality audit. Verified end to end against live data and re-checked the input schema, the output columns and the run configuration.
- Run reliability reviewed: 100.0% of public runs succeeded in the last 30 days.
- Input schema, output schema and pricing configuration reviewed.

#### 2026-09-01

- Fleet-wide health check. Verified against this Actor's real run history: 30-day success rate, output row counts, per-field fill rates, and peak memory against the configured memory limit.
- Reviewed for the failure patterns that have cost this fleet runs — unguarded proxy setup, retry loops that can outlast the run's own time budget, and full-page HTML parsing that can exhaust a small container.
- No change to input, output fields or scraping logic.

#### 2026-08-11

- Maintenance release: refreshed the build and dependencies.
- Re-verified live execution, non-empty structured output and dataset field/type integrity.
- Reviewed reliability (retries, pagination) and output quality as part of a full-fleet QA pass.

#### 2026-08-01

- Completed the August 2026 full health check: verified empty/programmatic default, Console UI default, and two source-informed alternative inputs on Apify.
- Confirmed successful live execution, non-empty structured output, dataset-field/type integrity, and logical sample quality within the 5-minute quality window.
- Fixed the run Output link from `{{links.apiDefaultDatasetUrl}}` to `{{links.apiDefaultDatasetUrl}}/items` so the results table opens the dataset items endpoint.

#### 2026-08-01 — Health-check remediation

- August 2026 monthly health-check remediation is in progress; this build contains fixes verified from empty/default, Console-default, targeted live probes, or field-level semantic review.
- Fixed the run Output link from `{{links.apiDefaultDatasetUrl}}` to `{{links.apiDefaultDatasetUrl}}/items` so the results table opens the dataset items endpoint.
- The final four-input matrix verdict will be appended after post-build cloud revalidation.

#### 2026-07-06

- ✨ README overhaul: badge/hero/callout structure, richer output sample, ready-to-run example scenarios, web-infra & security cross-promo links, expanded FAQ and clearer quick-start.

#### 2026-07-01

- Maintenance pass: re-verified end-to-end on live data and confirmed successful runs within the 5-minute quality window on the default input.
- Sharpened Store metadata (SEO title & description) and expanded the FAQ with high-intent, long-tail questions for easier discovery in Google and Apify Store search.
- Added ready-to-run example tasks that cover common real-world use cases.

#### 2026-06-24

- Initial release — 11 security header checks with weighted scoring, A+ to F grading, no API key, CSV/JSON export.

  </content>

***

\*Maintained: last verified 2026-11-01 — checked end-to-end against live run history (reliability, output fields and types, and time/memory budgets).

# Changelog

This Actor's version history is a separate document: https://apify.com/logiover/bulk-http-security-headers/changelog.md

# Actor input Schema

## `urls` (type: `array`):

List of URLs to scan for security headers. Paste one per line — HTTPS and HTTP both supported. Schemes are added automatically if missing. Leave EMPTY to scan a built-in set of well-known sites.

## `maxResults` (type: `integer`):

Maximum number of URLs to scan in this run. Keeps empty/large inputs fast and cheap. Raise it to process more.

## `sortBy` (type: `string`):

Order of the output rows.

## `maxConcurrency` (type: `integer`):

How many URLs to scan in parallel. Higher is faster.

## `proxyConfiguration` (type: `object`):

Proxy used for the HTTP requests. Recommended to avoid rate limiting.

## Actor input object example

```json
{
  "urls": [
    "https://github.com",
    "https://google.com",
    "https://example.com"
  ],
  "maxResults": 1000,
  "sortBy": "input",
  "maxConcurrency": 20,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `results` (type: `string`):

The dataset containing one row per URL with pass/fail for 11 security headers, a numeric score and letter grade.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://github.com",
        "https://google.com",
        "https://example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("logiover/bulk-http-security-headers").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://github.com",
        "https://google.com",
        "https://example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("logiover/bulk-http-security-headers").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://github.com",
    "https://google.com",
    "https://example.com"
  ]
}' |
apify call logiover/bulk-http-security-headers --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,logiover/bulk-http-security-headers"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ko6SoOWpBlnD7sDxE/builds/S38YIedhNEMdPpm8D/openapi.json