Twelve graded report cards for any site — each with the exact fix.

3 things to fix first: HTTP Strict Transport Security — Strict-Transport-Security: max-age=31536000; includeSubDomains

Core security — these set the grade

• !

  HTTPS enforcement

  Plain-HTTP requests don't redirect to HTTPS (got HTTP 522). Add an explicit upgrade so visitors are always moved to the secure URL.

  Fix Return a 301 redirect from every HTTP URL to its https:// equivalent.

• ✕

  HTTP Strict Transport Security

  No HSTS header. Browsers may still connect over insecure HTTP.

  Fix Strict-Transport-Security: max-age=31536000; includeSubDomains

• ✕

  Content-Security-Policy

  No CSP. This is the strongest defense against XSS and injection.

  Fix Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none'

• ✕

  X-Content-Type-Options

  Missing. Browsers may MIME-sniff and misinterpret responses.

  Fix X-Content-Type-Options: nosniff

• ✓

  Clickjacking protection

  X-Frame-Options: SAMEORIGIN

• ✓

  Referrer-Policy

  Set to a privacy-preserving value: same-origin

• ✓

  Cookie security

  No cookies were set on this response — nothing to secure.

• ✓

  Cross-Origin Resource Sharing

  No Access-Control-Allow-Origin header — the same-origin policy fully applies, so other sites can't read these responses.

Hygiene — 5 signals scored separately

These are worth fixing but none of them is how a site gets attacked, so they score out of 100 on their own and never move the letter grade. An A means the attacks that matter are covered; hygiene nudges rather than punishes.

• !

  Permissions-Policy

  Missing. Consider disabling features you don't use (camera, geolocation, etc.).

  Fix Permissions-Policy: geolocation=(), camera=(), microphone=()

• !

  Cross-Origin-Opener-Policy

  Missing. Helps isolate your window from cross-origin openers.

  Fix Cross-Origin-Opener-Policy: same-origin

• ✓

  Cache-Control sanity

  Explicit caching policy: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0

• !

  security.txt

  No /.well-known/security.txt — researchers who find a vulnerability have no sanctioned way to tell you.

  Fix Contact: mailto:security@yourdomain.com\nExpires: 2027-08-08T00:00:00Z (serve as /.well-known/security.txt)

  Check & generate your security.txt in Canopy →

• ✓

  Information disclosure

  No revealing Server version or X-Powered-By header.

Raw response headers (10)

cache-control	private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray	a28c5dd58e9ccf70-CMH
connection	close
content-length	16
content-type	text/plain; charset=UTF-8
date	Mon, 10 Aug 2026 04:48:07 GMT
expires	Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy	same-origin
server	cloudflare
x-frame-options	SAMEORIGIN

Embed this badge

Markdown

[![Canopy grade](https://canopystack.dev/badge?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev%2F)](https://canopystack.dev/?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev%2F)

HTML

<a href="https://canopystack.dev/?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev%2F"><img src="https://canopystack.dev/badge?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev%2F" alt="Canopy grade"></a>

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy security headers report — https://domain-project.jjraxx.workers.dev/ **Grade D** · 45/100 | | Check | Result | |---|---|---| | ⚠️ | HTTPS enforcement | Plain-HTTP requests don't redirect to HTTPS (got HTTP 522). Add an explicit upgrade so visitors are always moved to the secure URL. | | ❌ | HTTP Strict Transport Security | No HSTS header. Browsers may still connect over insecure HTTP. | | ❌ | Content-Security-Policy | No CSP. This is the strongest defense against XSS and injection. | | ❌ | X-Content-Type-Options | Missing. Browsers may MIME-sniff and misinterpret responses. | | ✅ | Clickjacking protection | X-Frame-Options: SAMEORIGIN | | ✅ | Referrer-Policy | Set to a privacy-preserving value: same-origin | | ⚠️ | Permissions-Policy | Missing. Consider disabling features you don't use (camera, geolocation, etc.). | | ⚠️ | Cross-Origin-Opener-Policy | Missing. Helps isolate your window from cross-origin openers. | | ✅ | Cookie security | No cookies were set on this response — nothing to secure. | | ✅ | Cross-Origin Resource Sharing | No Access-Control-Allow-Origin header — the same-origin policy fully applies, so other sites can't read these responses. | | ✅ | Cache-Control sanity | Explicit caching policy: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 | | ⚠️ | security.txt | No /.well-known/security.txt — researchers who find a vulnerability have no sanctioned way to tell you. | | ✅ | Information disclosure | No revealing Server version or X-Powered-By header. | ### Fixes - **HTTPS enforcement:** Return a 301 redirect from every HTTP URL to its https:// equivalent. - **HTTP Strict Transport Security:** Strict-Transport-Security: max-age=31536000; includeSubDomains - **Content-Security-Policy:** Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none' - **X-Content-Type-Options:** X-Content-Type-Options: nosniff - **Permissions-Policy:** Permissions-Policy: geolocation=(), camera=(), microphone=() - **Cross-Origin-Opener-Policy:** Cross-Origin-Opener-Policy: same-origin - **security.txt:** Contact: mailto:security@yourdomain.com\nExpires: 2027-08-08T00:00:00Z (serve as /.well-known/security.txt) — [Check & generate your security.txt in Canopy](https://canopystack.dev/security-txt?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev) [Full report](https://canopystack.dev/?url=https%3A%2F%2Fdomain-project.jjraxx.workers.dev%2F) · graded by [Canopy](https://canopystack.dev)

Share it: save a snapshot — a permanent link to this exact result (kept 90 days).

Also check: CSP deep-dive · SEO · Performance · Accessibility · Link health · AI readiness · Cookies · PWA · Privacy & trackers · Redirects · Exposed files · security.txt · robots.txt · Sitemap audit · Social preview · Multi-page sweep · Email · DNS · everything at once · Trends

Fix these in one go: generate a fix pack for exactly these findings → · the full reference set

Machine-readable: /api/scan?url=…

Canopy · Security-headers report · https://domain-project.jjraxx.workers.dev/ · Mon, 10 Aug 2026 04:48 UTC · generated with Canopy — https://canopystack.dev