HTTP Header Check
Copy the response headers out of devtools or curl -I and paste them here. You get a plain reading of what each one does, which protections are missing, and exactly how long the answer will sit in a cache.
Response headers
A status line at the top is fine, and so are the :method style pseudo headers devtools sometimes includes.
Verdict
-
Findings
Paste some headers to see the checks.
Every header you pasted