HTTP Header Inspector

Browser-visible grade only. Fetches the URL from your browser, so the score is computed against headers your browser is allowed to read (per the server's Access-Control-Expose-Headers). A "missing" verdict can mean the header is genuinely not set or the server simply doesn't expose it to JS. For an authoritative grade use a server-side scanner (e.g. securityheaders.com) or curl -I <url>.