PulseTrace
Start free
All free tools
Free tool

Security headers grader — HSTS, CSP, X-Frame-Options and cookies, graded A+ to F

Enter a URL and PulseTrace fetches it (following redirects), then scores the security headers and cookie flags with the same rules the SSL/TLS Security monitor uses — so the grade here is the grade your monitor would show for these categories.

Monitor this continuously

Get an alert the moment this grade changes — a dropped header after a deploy, a cookie that lost HttpOnly — and a TLS grade alongside it.

Start free SSL/TLS Security monitor

How to read the result

  1. 1HTML responses are graded as browser pages: HSTS 10, CSP 12, nosniff 3, clickjacking 3, Referrer-Policy 1, Permissions-Policy 1. Non-HTML (JSON, redirects to APIs) is graded as an API: HSTS only, the rest shown but unscored.
  2. 2CSP is scored on what it actually restricts — a policy of script-src * scores like no policy. A nonce or hash neutralises 'unsafe-inline', so the standard fallback pattern is not penalised.
  3. 3Cookies count in both profiles (Secure 4, HttpOnly 4, SameSite 2), weakest cookie wins; a response that sets none has the category excluded, not awarded.
  4. 4The grade is the percentage of available points: A+ ≥ 95, A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, F below.

Questions

Why did my API endpoint score well with almost no headers?
Because browser-page headers do not apply to it: CSP, framing and nosniff protect rendered pages. An API response is graded on HSTS and cookie flags, which do apply. The other headers are still listed so you can add them if the endpoint also serves browsers.
I have a CSP but it scored zero. Why?
Look at the weaknesses list. The usual reasons: script-src (or default-src) allows * or https:, 'unsafe-inline' without a nonce/hash, no object-src 'none', or no base-uri (default-src does not cover it). A Report-Only policy scores 1 point for being present and nothing for what it would block.
Does this check the TLS configuration too?
No — this tool grades the response headers and cookies. Use the SSL certificate checker for the handshake basics, or the SSL/TLS Security monitor for the full 120-point grade that combines both.

Other free tools

SSL certificate checkerDNS lookupIs it down?SLA & uptime calculatorCron expression builderSecurity headers grading →