Content-Type: text/html; charset=utf-8
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Cache-Control: public, max-age=3600
Server: nginx/1.24

═══ Security scorecard — grade D (56%) ═══
Headers parsed: 6
Passed: 2
Warnings: 5
Failed: 1

═══ Checks ═══
⚠ HSTS (Strict-Transport-Security) — Present but subdomains are unprotected.
  Fix: Add includeSubDomains once every subdomain serves HTTPS.
✗ CSP (Content-Security-Policy) — Missing — nothing constrains where scripts, styles or frames may come from.
  Fix: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
✓ MIME sniffing (X-Content-Type-Options) — nosniff — browsers honour your Content-Type.
✓ Clickjacking (X-Frame-Options) — DENY — framing blocked in legacy browsers.
  Fix: Also add CSP frame-ancestors for modern browsers.
⚠ Referrer (Referrer-Policy) — Missing — browsers default to strict-origin-when-cross-origin, but be explicit.
  Fix: Referrer-Policy: strict-origin-when-cross-origin
⚠ Permissions (Permissions-Policy) — Missing — every powerful feature stays available to this page and its iframes.
  Fix: Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
⚠ Cross-origin isolation (Cross-Origin-Opener-Policy) — Missing — cross-origin openers keep a handle on this window (XS-Leaks).
  Fix: Cross-Origin-Opener-Policy: same-origin
⚠ Version disclosure (server) — server: nginx/1.24 tells an attacker exactly what to look up in a CVE database.
  Fix: Remove or blank the server header at the proxy.

═══ Caching behaviour ═══
─── Caching ───
Cache-Control: public, max-age=3600
Browser freshness: 3600s (1h)

═══ All headers (6) ═══
content-type: text/html; charset=utf-8
strict-transport-sec
…