Arsenly
Tools
Free Tools
Pricing
Resources
Sign in Get started
← All tools

Security Header Analyzer

Web Security Audit

Grade a URL’s security posture - headers, cookies, CSP weaknesses, info-disclosure and the redirect chain - with prioritized findings.

What is Security Header Analyzer?

Security Header Analyzer follows the target’s own redirect chain, then evaluates the response that actually reaches the browser - security headers, cookie flags, CSP directives, leaked technology and CORS exposure - and assigns a weighted A-F grade.

Every issue comes back ranked High → Info with a one-line explanation and a concrete fix, turning the often-overlooked header layer into an actionable checklist for hardening reviews and client reports.

Two input modes: fetch a live URL, or paste a raw HTTP response straight from Burp, DevTools or curl - so you can grade the headers of authenticated, WAF’d or internal responses the live fetcher would never see, with nothing sent to the target.

What it analyzes

  • Transport & HSTS - HTTPS enforcement, HSTS max-age / includeSubDomains / preload, and HTTPS→HTTP downgrades in the redirect chain.
  • Content-Security-Policy - presence plus weak directives: unsafe-inline, unsafe-eval, wildcard sources and missing object-src / base-uri.
  • Clickjacking - X-Frame-Options or CSP frame-ancestors.
  • Cookie flags - per-cookie Secure / HttpOnly / SameSite audit, with session-cookie heuristics.
  • Info-disclosure - Server / X-Powered-By / framework version headers that fingerprint the stack.
  • CORS exposure - wildcard or credentialed Access-Control-Allow-Origin combinations worth probing further.
  • Weighted grade - a single A-F score plus a severity-ranked findings list you can copy or export as JSON.

Where it fits in your workflow

  • Fast hardening pass for a site or a portfolio of hosts.
  • Spot cookie / CORS / clickjacking weaknesses to chase in a bug-bounty target.
  • Generate a severity-ranked header remediation report.
Use Security Header Analyzer

Run it from your dashboard.

Create free account Sign in Use via API

At a glance

CategoryWeb Security Audit
RunsServer-side
Token cost 2 / run (free tier)
Access Free
Status● Live

Frequently asked questions

Can I analyze a response that needs login or is behind a WAF?

Yes - switch to the “Paste response” tab and paste the raw HTTP response from Burp, DevTools (Copy response) or curl -i. It is parsed locally and graded with the same engine; nothing is sent to the target, and HTTP/1.x and HTTP/2 pastes both work.

Does it follow redirects?

Yes - in URL mode it follows the target’s own redirect chain (up to 6 hops) and analyzes the final response, while flagging any HTTPS→HTTP downgrade along the way.

How is this different from the CSP / CORS Analyzer?

This grades the full set of security headers, cookies and the redirect chain at a high level. The CORS Misconfig Tester drills specifically into cross-origin exposure with crafted Origins.

Explore more tools →