What does your site let browsers do?
A few headers decide what another site is allowed to do with your pages.
Absent by default, and nothing looks wrong
No server sends these on its own. A site nobody has configured has none of them, works perfectly, and gives away every protection it could have had for free.
Your page inside someone else's
With nothing set, another site can load your page in an invisible frame over its own buttons, so a click meant for theirs lands on yours. On anything with a Buy or a Delete, that is the whole attack.
One script reads every session
A cookie without HttpOnly can be read by any JavaScript on the page. That turns a small flaw somewhere else into somebody else's login.
The first request is in the clear
Without HSTS, a visitor typing your domain starts on http. Your redirect fixes it afterwards, and the request that triggered the redirect has already been sent.
Headers in, an answer out
Copy your response headers
F12, the Network tab, click the first request, copy what is under Response Headers. Or curl -sSI yoursite.com.
Paste them here
The status line and the order do not matter. The check runs in your browser.
See what you are allowing
Every gap ranked by what it opens up, with the exact header to send and what to set it to.
What it checks
Whether anyone can frame your pages
Answered by frame-ancestors or X-Frame-Options, and it takes only one of them. With neither, the answer is that anyone can.
Whether https is actually enforced
HSTS, and its max-age rather than just its presence. A header set to zero tells browsers to forget the rule, and reads as configured.
Whether script can read your cookies
Secure, HttpOnly and SameSite, named per cookie. A cookie meant to be read by script is treated differently from one carrying a login.
Whether your CSP does anything
A policy can be present and permit everything. 'unsafe-inline' gives back most of what a CSP is for, and a wildcard source allows any host on the internet.
Whether file types are guessed
Without nosniff a browser can decide a file is a script because of what is inside it, whatever type you sent with it.
What you announce to strangers
An exact server version, and a referrer policy that decides how much of your addresses is handed to every site you link to.
Straight talk about what it cannot see
It reads the headers of the one response you paste, and is clear about how far that goes.
One response is not your whole site
Your API, your uploads and your admin pages can all send different headers, and a missing one there counts just as much. Check more than the home page.
It does not judge whether your CSP fits
It reports the parts that are known to defeat a policy. Whether the sources you allow are the right ones is a question about your site, not about the header.
Headers are one layer
They limit what a browser will do. They say nothing about your server, your dependencies, or what your own code does with what it is handed.
Your headers never leave your machine
The whole check runs in your browser. Nothing is uploaded, which is also why there is no limit on it.
Four headers and an afternoon
Most of what is missing here is configuration, not code, and it is the cheapest security work there is.