What the browser is told
The eight headers a browser reads on the way in — CSP, HSTS, X-Frame-Options and the rest — scored out of 100 and graded. Present is not the same as sound. Free, no signup, 5 checks a day.
5 free checks a day. No signup, no key.
Eight headers, eight ways to say no
CSP
Content-Security-Policy — names the sources a page is allowed to load. A CSP that includes 'unsafe-inline' is marked weak: it is present, but it no longer stops the injections it exists to stop.
HSTS
Strict-Transport-Security — tells browsers to refuse plain HTTP for a window of time. A one-minute max-age is marked weak: it is a policy that expires before most visitors come back.
Framing
X-Frame-Options — decides whether other sites may embed this one in a frame. Missing means your pages can be framed by anyone — the classic clickjacking surface.
MIME sniffing
X-Content-Type-Options — stops browsers from guessing a file's type when the declared type is missing. Without it, an uploaded file that pretends to be HTML can run as one.
Referrer
Referrer-Policy — controls what the browser leaks about the previous page in the URL of the next request. The stricter it is, the less of your users' path appears in third-party logs.
Permissions
Permissions-Policy — switches off browser features (camera, microphone, geolocation) for the page and its frames. Absent means every feature is on until some script asks for it.
COOP
Cross-Origin-Opener-Policy — isolates the browsing context so a cross-origin popup cannot hold a reference to this window. Missing weakens the wall between your page and the sites it opens.
CORP
Cross-Origin-Resource-Policy — says which origins may embed this page's resources. Without it, any other origin can read what this page serves.