Result
Your headers
Plain HTTP
WaitingStrict-Transport-Security
WaitingTells the browser to use HTTPS for every later visit to this host.
Waiting for a checkMDN: Strict-Transport-SecurityContent-Security-Policy
WaitingSays which scripts, styles, images, and frames the page may load.
Waiting for a checkMDN: Content-Security-PolicyFraming
WaitingStops another site from putting this page inside a frame.
Waiting for a checkMDN: X-Frame-OptionsX-Content-Type-Options
WaitingStops the browser from guessing a file's type from its content.
Waiting for a checkMDN: X-Content-Type-OptionsReferrer-Policy
WaitingLimits what the page's address reveals to the sites it links to.
Waiting for a checkMDN: Referrer-PolicyPermissions-Policy
WaitingTurns off the camera, microphone, location, and similar for the page and every frame in it.
Waiting for a checkMDN: Permissions-Policy
The lines to add
On Cloudflare and Netlify these go in a _headers file next to the site. On Vercel, in vercel.json. On nginx, as add_header lines. The blog has the details.
Not graded, worth knowing
Rules fromMDN Web Docs, HTTP headersRead against the source on 2026-09-02.
Response fromthe checked page