Audit HSTS, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers and compute an A-to-C security posture grade.