Audit security headers

{ "body": { "headers": [ { "name": "Strict-Transport-Security", "value": "max-age=0" }, { "name": "Content-Security-Policy", "value": "default-src 'none'" } ], "transport": "https" }, "bodyType": "json", "method": "POST", "type": "http" }

{ "example": { "checkedAt": "2026-11-03T16:00:00.000Z", "confirmedCount": 3, "finalUrl": "", "findings": [ { "code": "hsts_disabled", "detail": "Strict-Transport-Security sets max-age to 0.", "kind": "confirmed", "subject": "strict-transport-security" }, { "code": "content_type_options_missing", "detail": "X-Content-Type-Options was absent.", "kind": "confirmed", "subject": "x-content-type-options" }, { "code": "framing_control_missing", "detail": "Neither X-Frame-Options nor CSP frame-ancestors was present.", "kind": "confirmed", "subject": "x-frame-options" }, { "code": "referrer_policy_missing", "detail": "Referrer-Policy was absent.", "kind": "recommendation", "subject": "referrer-policy" }, { "code": "permissions_policy_missing", "detail": "Permissions-Policy was absent.", "kind": "recommendation", "subject": "permissions-policy" } ], "httpStatus": 0, "limitations": [ "These checks do not show that a website is secure.", "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.", "A path or endpoint is requested only when the caller lists it.", "Cookie values are not copied into the response.", "An unavailable check means that configuration was not in the response." ], "present": [ "content-security-policy", "strict-transport-security" ], "recommendationCount": 2, "requestedUrl": "", "requestsSent": 0, "securityDetermined": false, "status": "checked", "transport": "https", "unavailableCount": 0, "websiteSecure": false }, "type": "json" }