Grade a URL’s security posture - headers, cookies, CSP weaknesses, info-disclosure and the redirect chain - with prioritized findings.
Security Header Analyzer follows the target’s own redirect chain, then evaluates the response that actually reaches the browser - security headers, cookie flags, CSP directives, leaked technology and CORS exposure - and assigns a weighted A-F grade.
Every issue comes back ranked High → Info with a one-line explanation and a concrete fix, turning the often-overlooked header layer into an actionable checklist for hardening reviews and client reports.
Two input modes: fetch a live URL, or paste a raw HTTP response straight from Burp, DevTools or curl - so you can grade the headers of authenticated, WAF’d or internal responses the live fetcher would never see, with nothing sent to the target.
Yes - switch to the “Paste response” tab and paste the raw HTTP response from Burp, DevTools (Copy response) or curl -i. It is parsed locally and graded with the same engine; nothing is sent to the target, and HTTP/1.x and HTTP/2 pastes both work.
Yes - in URL mode it follows the target’s own redirect chain (up to 6 hops) and analyzes the final response, while flagging any HTTPS→HTTP downgrade along the way.
This grades the full set of security headers, cookies and the redirect chain at a high level. The CORS Misconfig Tester drills specifically into cross-origin exposure with crafted Origins.