ChimeraMiND Data
Home / Tools / Domain Security Audit (TLS, HTTP headers, redirects, robots)
Developer tools

Domain Security Audit (TLS, HTTP headers, redirects, robots)

Domain Security Audit checks TLS certificate validity, HSTS/CSP and other HTTP security headers, the redirect chain and robots.txt/llms.txt AI-bot rules for any list of domains — one scored, graded row per domain.

Run Domain Security Audit (TLS, HTTP headers, redirects, robots) on Apify →

Read the step-by-step guide

Pricing

Apify planPer resultPer 1,000
Free plan$0.005$5
Starter$0.004$4
Scale$0.0035$3.50
Business$0.003$3
Enterprise$0.003$3
Enterprise+$0.003$3

Primary event rates from a catalog snapshot; this is not the total price of a run. Additional charge events and Actor Start fees may apply; start fees can scale with memory. Check the Actor's Pricing tab on Apify for all events, conditions and current plan-specific rates, and set a maximum run budget before starting.

Sample output

Recorded example · 0 days old. This is a snapshot, not current data.run mCNhIQq5s8nvQHoOg · 2026-10-18
{
  "domain": "sqlite.org",
  "certValidFrom": "2026-08-01T01:03:35.000Z",
  "certValidTo": "2026-10-30T01:03:34.000Z",
  "certDaysUntilExpiry": 11,
  "certIssuerOrg": "Let's Encrypt",
  "certIssuerCN": "YE1",
  "certSubjectCN": "a1.sqlite.org",
  "certSanCount": 29,
  "certAuthorized": true,
  "tlsProtocol": "TLSv1.3",
  "finalUrl": "https://sqlite.org/",
  "redirectHops": 1,
  "redirectChain": [
    {
      "url": "http://sqlite.org/",
      "status": 301,
      "location": "https://sqlite.org/"
    },
    {
      "url": "https://sqlite.org/",
      "status": 200,
      "location": null
    }
  ],
  "httpsRedirect": true,
  "wwwRedirect": false,
  "hasHsts": false,
  "hstsMaxAge": null,
  "hstsIncludeSubdomains": false,
  "hstsPreload": false,
  "hasCsp": false,
  "cspHasUnsafeInline": false,
  "xFrameOptions": null,
  "xContentTypeOptions": null,
  "referrerPolicy": null,
  "permissionsPolicy": null,
  "server": null,
  "xPoweredBy": null,
  "cacheControl": "max-age=120",
  "cookieCount": 0,
  "secureCookieCount": 0,
  "httpOnlyCookieCount": 0,
  "sameSiteCookieCount": 0,
  "robotsStatus": 200,
  "robotsDisallowAll": false,
  "robotsSitemapCount": 0,
  "aiBotsDisallowed": [],
  "llmsTxtExists": false,
  "llmsTxtTitle": null,
  "llmsTxtSize": null,
  "securityScore": 50,
  "securityGrade": "C",
  "issues": [
    "TLS certificate expires in 11 day(s)",
    "No HSTS header",
    "No Content-Security-Policy header"
  ],
  "error": null,
  "scrapedAt": "2026-10-18T17:00:59.536Z"
}

Call from code

Use the existing catalog input below as a starting point. Review the tool's input form on Apify before running it.

import json
import os
from apify_client import ApifyClient

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("webdatatools/domain-security-audit").call(run_input=json.loads("{\n    \"domains\": [\n        \"apify.com\",\n        \"example.com\"\n    ],\n    \"checkTls\": true,\n    \"checkHeaders\": true\n}"))

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('webdatatools/domain-security-audit').call({
    "domains": [
        "apify.com",
        "example.com"
    ],
    "checkTls": true,
    "checkHeaders": true
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
curl -X POST "https://api.apify.com/v2/acts/webdatatools~domain-security-audit/run-sync-get-dataset-items" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com","example.com"],"checkTls":true,"checkHeaders":true}'

Related tools

Workflows