HTTPS enforcement, HSTS, Content-Security-Policy, clickjacking protection, and cookie flag hygiene (Secure/HttpOnly/SameSite) — read from your site's real response headers. A header-hygiene check, not a penetration test.
Checks the headers your server actually sends, on every crawled page.
Clickjacking exposure checked correctly — only flagged when neither X-Frame-Options nor a CSP frame-ancestors directive is present.
Every missing header or cookie flag cited as evidence, with a concrete header to add.