Security headers checker

What it checks

• HTTP Strict Transport SecurityTells returning browsers to never try http first, closing the window where a connection can be hijacked.
• Content Security PolicyA policy stops an injected script from running even if an attacker gets one onto the page.
• Clickjacking protectionWithout it another site can load yours invisibly in a frame and trick visitors into clicking.
• MIME sniffing disabledStops browsers guessing a file's type, which turns an uploaded "image" into an executable script.
• Referrer policyDecides how much of the current URL is sent to sites you link to. Tokens and IDs in URLs leak without one.
• Cookie flagsA session cookie without Secure and HttpOnly can be stolen by a script or over an open network.
• Server version disclosureA version number in a header tells an attacker exactly which published exploits to try.
• Exposed sensitive filesA readable `.env`, `.git` folder or database dump is the whole site's secrets in one request.
• Directory listingA folder that lists its files shows every upload and backup to anybody who looks.

Questions