Enter a URL. The server makes a real request, lists every response header, and scores six key security headers — telling you what is missing and how to add it.
Notes
Only 80/443 are allowed, and the actual dialed IP is verified — private and metadata addresses are rejected.
The score only reflects these six "set it and it works" headers, not overall security.
A broken CSP is worse than none (it white-screens the site). Validate in report-only mode first.