Security headers
HSTS, CSP and the rest, as served.
The check runs on our server. We do not store the domain.
What this checks
This tool fetches the domain's home page over HTTPS and reads six response headers that browsers use to lock down a site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Every other header the server sends is listed too, under "Other headers".
What to look for
A header marked "not sent" is a gap, not necessarily a bug — plenty of sites run fine without all six. Strict-Transport-Security matters most: without it, a visitor's first request can still go out over plain HTTP before the redirect to HTTPS happens. Its max-age should be at least six months; a short one barely helps.
A missing header is not a missing site
This only reads what the server sent back. It does not try to break in, and a clean result here says nothing about the rest of the site's security.