Paste any public URL. We read its HTTP response headers and grade the security posture - HSTS, CSP, frame protection, cookie flags and more - with the exact lines to fix what's missing.