PulseTrace
Start free
All features
HTTP security

Security headers, cookies and CORS — graded on every check

HSTS, CSP, X-Frame-Options, cookie flags, CORS policy: the controls that stop whole classes of attack, and the ones that quietly disappear after a deploy. PulseTrace grades them on every check and alerts when the grade drops.

The SSL/TLS Security monitor inspects the response headers served over TLS — HSTS and its max-age, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options — plus Set-Cookie flags (Secure, HttpOnly, SameSite), CORS headers and redirect behaviour, and folds them into the endpoint's letter grade.

Findings are listed individually, with what was expected and what was found, so 'B' is never a mystery. A dropped header is also a change event on the timeline — the moment it happens, with the deploy window right next to it.

  • Findings, not just a letter — each failing control with expected vs. found.
  • Cookie & CORS checks alongside the classic headers.
  • Scoring modes so report-only controls don't drag a grade until you promote them.
  • Trust pages publish the grade to customers who ask.
Start monitoring free Security posture in depth
app.pulsetrace.app · security headers grading

How it works

  1. 1Add an SSL/TLS Security monitor for the URL and pick a scoring mode (Low / Medium / High).
  2. 2Each check grades transport, certificate and headers; Medium and High count headers toward the grade.
  3. 3Grade downgrades and header removals alert your destinations and open changes.

Plan availability

Team and above (SSL/TLS security posture); trust pages with grades on Pro and above.

Compare plans →

Monitor types that use it

SSL/TLS SecurityHTTP(S)

Pairs with

Slack Microsoft Teams Email

Questions about security headers grading

Will a missing CSP fail the monitor?
It lowers the grade (and opens a change when it disappears); whether that pages anyone is your alert rule — most teams alert on a grade drop, not on every finding.
Do you check every page of my site?
Each monitor grades one URL; add monitors for the login page, the app root and the API root to cover the surfaces that matter.
← Multi-step API checksChange detection →