{"domain":"example.com","https_enabled":true,"score":9,"score_class":"score-low","headers":[{"name":"content-security-policy","value":null,"present":false,"recommendation":"Controls resources the browser can load. Prevents XSS."},{"name":"x-content-type-options","value":null,"present":false,"recommendation":"Prevents MIME type sniffing. Should be 'nosniff'."},{"name":"x-frame-options","value":null,"present":false,"recommendation":"Controls framing. Use CSP frame-ancestors instead."},{"name":"strict-transport-security","value":null,"present":false,"recommendation":"Forces HTTPS. Recommended: max-age=31536000; includeSubDomains"},{"name":"referrer-policy","value":null,"present":false,"recommendation":"Controls referrer info. Recommended: strict-origin-when-cross-origin"},{"name":"permissions-policy","value":null,"present":false,"recommendation":"Controls browser features. Recommended: camera=(), microphone=(), geolocation=()"},{"name":"cross-origin-opener-policy","value":null,"present":false,"recommendation":"Controls cross-origin window access. Recommended: same-origin"},{"name":"cross-origin-resource-policy","value":null,"present":false,"recommendation":"Controls cross-origin resource access. Recommended: same-origin"},{"name":"cross-origin-embedder-policy","value":null,"present":false,"recommendation":"Controls cross-origin embedding. Recommended: require-corp"},{"name":"cache-control","value":null,"present":false,"recommendation":"Caching policy. Use no-store/private for sensitive pages."},{"name":"x-powered-by","value":null,"present":false,"recommendation":"Should be removed. Reveals server technology to attackers."}],"optional":[{"name":"set-cookie","value":null,"present":false,"info":"Optional — only relevant if site sets cookies. Sites without cookies are fine. If present, check Secure, HttpOnly, SameSite flags."},{"name":"report-to","value":null,"present":false,"info":"Optional — CSP violation reporting endpoint. Configure for production monitoring."}],"deprecated":[{"name":"x-xss-protection","value":null,"present":false,"suggestion":"Deprecated — not in use, no action needed."},{"name":"expect-ct","value":null,"present":false,"suggestion":"Deprecated — CT is now browser-enforced, no action needed."}],"errors":["Missing header: content-security-policy","Missing header: x-content-type-options","Missing header: x-frame-options","Missing header: strict-transport-security","Missing header: referrer-policy","Missing header: permissions-policy","Missing header: cross-origin-opener-policy","Missing header: cross-origin-resource-policy","Missing header: cross-origin-embedder-policy","Missing header: cache-control","Missing recommended header: content-security-policy","Missing recommended header: x-content-type-options","Missing recommended header: strict-transport-security","Missing recommended header: referrer-policy"],"successes":["x-powered-by: Not exposed (good — reduces fingerprinting)","HTTPS is enabled"],"issues":[{"issue":"Missing: content-security-policy","recommendation":"Controls resources the browser can load. Prevents XSS."},{"issue":"Missing: x-content-type-options","recommendation":"Prevents MIME type sniffing. Should be 'nosniff'."},{"issue":"Missing: x-frame-options","recommendation":"Controls framing. Use CSP frame-ancestors instead."},{"issue":"Missing: strict-transport-security","recommendation":"Forces HTTPS. Recommended: max-age=31536000; includeSubDomains"},{"issue":"Missing: referrer-policy","recommendation":"Controls referrer info. Recommended: strict-origin-when-cross-origin"},{"issue":"Missing: permissions-policy","recommendation":"Controls browser features. Recommended: camera=(), microphone=(), geolocation=()"},{"issue":"Missing: cross-origin-opener-policy","recommendation":"Controls cross-origin window access. Recommended: same-origin"},{"issue":"Missing: cross-origin-resource-policy","recommendation":"Controls cross-origin resource access. Recommended: same-origin"},{"issue":"Missing: cross-origin-embedder-policy","recommendation":"Controls cross-origin embedding. Recommended: require-corp"},{"issue":"Missing: cache-control","recommendation":"Caching policy. Use no-store/private for sensitive pages."},{"issue":"Missing recommended header: content-security-policy","recommendation":"Review and fix this security issue"},{"issue":"Missing recommended header: x-content-type-options","recommendation":"Review and fix this security issue"},{"issue":"Missing recommended header: strict-transport-security","recommendation":"Review and fix this security issue"},{"issue":"Missing recommended header: referrer-policy","recommendation":"Review and fix this security issue"}],"raw_headers":[{"name":"date","value":"Sun, 02 Aug 2026 21:12:20 GMT"},{"name":"content-type","value":"text/html"},{"name":"transfer-encoding","value":"chunked"},{"name":"connection","value":"keep-alive"},{"name":"server","value":"cloudflare"},{"name":"last-modified","value":"Sat, 01 Aug 2026 09:39:03 GMT"},{"name":"allow","value":"GET, HEAD"},{"name":"accept-ranges","value":"bytes"},{"name":"age","value":"6467"},{"name":"cf-cache-status","value":"HIT"},{"name":"cf-ray","value":"a250148b3e56e0fe-ARN"}]}