Security
Method: deduction-based.
Checks:
- HSTS (presence, includeSubDomains, max-age length)
- Content – Security-Policy (presence + strength)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy (presence + strength)
- Permissions-Policy
- cross-origin policies
- exposed `Server`/`X-Powered-By` headers
- inline script density.