Audit raw HTTP response headers against OWASP hardening guidance and score the posture.
Add: default-src 'self'; script-src 'self' — Restrict loadable resources; avoid unsafe-inline/eval
Add: max-age=31536000; includeSubDomains — Force HTTPS for the domain
Add: DENY — Prevent clickjacking
Add: nosniff — Block MIME-type sniffing
Suggested: strict-origin-when-cross-origin
Suggested: geolocation=(), camera=(), microphone=()
Suggested: no-store for sensitive responses
Leaks server/stack details to attackers — remove or mask
Leaks server/stack details to attackers — remove or mask
Leaks server/stack details to attackers — remove or mask
Not part of the standard hardening checks
Leaks server/stack details to attackers — remove or mask
Missing Secure, HttpOnly, SameSite