We use cookies
Some are needed to run the site and keep you signed in. Others help us understand what’s useful through analytics. We don’t run analytics until you agree. Cookie details
Reads the headers that decide whether another site can frame your pages, whether script can read your cookies, and whether https is enforced.
This check is part of the membership
Members run it on their own pages, with every other check, the decision tools and the courses.
Headers are the cheapest security a site has, because they are configuration rather than code, and most sites ship without them because nothing breaks when they are missing. HSTS is the one worth setting first: without it, the first request a browser makes to your domain can still be plain http.
Headers are one layer. A site can carry every one of these and still be insecure in ways no header reaches.
