Try it
What it checks
- Reads the headers the page really sends, after any redirect.
- Grades HSTS, Content-Security-Policy, framing, nosniff, Referrer-Policy and Permissions-Policy.
- Writes each missing header for Next.js, Apache, Nginx, Netlify or Vercel when it can tell which.
- Counts the cookies that are both Secure and SameSite.