Security headers of a URL's final response: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, each with present, value, ok and advice. Also cookies missing Secure, HttpOnly or SameSite (names only), version leaks in Server or X-Powered-By, and a grade from A to F.

Payment Options