Twelve graded report cards for any site — each with the exact fix.
Try: this site · github.com · example.com
6 things to fix first: HTTPS enforcement — Return a 301 redirect from every HTTP URL to its https:// equivalent (then add HSTS to lock it in).
Core security — these set the grade
-
HTTPS enforcement
The site also answers over plain HTTP without redirecting to HTTPS — a visitor typing the bare domain can land on an insecure connection.
Fix
Return a 301 redirect from every HTTP URL to its https:// equivalent (then add HSTS to lock it in). -
HTTP Strict Transport Security
No HSTS header. Browsers may still connect over insecure HTTP.
Fix
Strict-Transport-Security: max-age=31536000; includeSubDomains -
Content-Security-Policy
No CSP. This is the strongest defense against XSS and injection.
Fix
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none' -
X-Content-Type-Options
Missing. Browsers may MIME-sniff and misinterpret responses.
Fix
X-Content-Type-Options: nosniff -
Clickjacking protection
No framing protection — the page can be embedded in a hostile iframe.
Fix
Content-Security-Policy: frame-ancestors 'none' (or X-Frame-Options: DENY) -
Referrer-Policy
Missing. Full URLs may leak to third parties via the Referer header.
Fix
Referrer-Policy: strict-origin-when-cross-origin -
Cookie security
No cookies were set on this response — nothing to secure.
-
Cross-Origin Resource Sharing
No Access-Control-Allow-Origin header — the same-origin policy fully applies, so other sites can't read these responses.
-
Mixed content
No http:// subresources found in the page's HTML.
Hygiene — 6 signals scored separately
These are worth fixing but none of them is how a site gets attacked, so they score out of 100 on their own and never move the letter grade. An A means the attacks that matter are covered; hygiene nudges rather than punishes.
-
Permissions-Policy
Missing. Consider disabling features you don't use (camera, geolocation, etc.).
Fix
Permissions-Policy: geolocation=(), camera=(), microphone=() -
Cross-Origin-Opener-Policy
Missing. Helps isolate your window from cross-origin openers.
Fix
Cross-Origin-Opener-Policy: same-origin -
Cache-Control sanity
No Cache-Control (or Expires) header — every browser and intermediary cache decides for itself whether and how long to cache this response.
Fix
Cache-Control: no-store (for dynamic/personalized pages) or an explicit public, max-age=… for truly static ones -
Subresource Integrity
Every third-party script and stylesheet carries an integrity attribute (or there are none).
-
security.txt
No /.well-known/security.txt — researchers who find a vulnerability have no sanctioned way to tell you.
Fix
Contact: mailto:security@yourdomain.com\nExpires: 2027-08-08T00:00:00Z (serve as /.well-known/security.txt) -
Information disclosure
No revealing Server version or X-Powered-By header.
Raw response headers (10)
| accept-ranges | bytes |
| allow | GET, HEAD |
| cf-cache-status | MISS |
| cf-ray | a28c55b348f6c892-CMH |
| connection | close |
| content-type | text/html |
| date | Mon, 10 Aug 2026 04:42:35 GMT |
| last-modified | Sat, 08 Aug 2026 20:05:49 GMT |
| server | cloudflare |
| transfer-encoding | chunked |
Embed this badge
[](https://canopystack.dev/?url=https%3A%2F%2Fexample.com%2F)
<a href="https://canopystack.dev/?url=https%3A%2F%2Fexample.com%2F"><img src="https://canopystack.dev/badge?url=https%3A%2F%2Fexample.com%2F" alt="Canopy grade"></a>
Share it: save a snapshot — a permanent link to this exact result (kept 90 days).
Fix these in one go: generate a fix pack for exactly these findings → · the full reference set
Machine-readable: /api/scan?url=…
Canopy · Security-headers report · https://example.com/ · Mon, 10 Aug 2026 04:42 UTC · generated with Canopy — https://canopystack.dev
Run every layer on this domain → · or browse the whole suite.