Checks which common security-related HTTP headers a website sends, and shows the full raw response headers.
This looks for seven commonly recommended security headers - Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. The score is a simple count of how many are present; it's our own simplified rubric, not an official standard or certification, and a missing header doesn't automatically mean a site is insecure - context matters (for example, a strict Content-Security-Policy can make X-Frame-Options redundant).
The check runs from our server, following redirects, and reads the final response's headers - the same headers your browser would receive.
Read more: 7 HTTP Security Headers Every Website Should Have.