Security headers checked by Toolmera
The report checks Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. These headers address different browser behaviors, so the tool reports them separately instead of collapsing every security concern into one vague score.
The grade is intentionally simple: it reflects HTTPS plus the number of checked headers present. It does not prove that a policy is perfectly configured, that an application has no vulnerabilities or that every missing header is required for every site.
CSP, framing and MIME protections solve different problems
Content-Security-Policy can constrain where scripts, styles and other resources may load from. X-Frame-Options controls older framing behavior, while frame-ancestors in CSP can provide more flexible framing policy. X-Content-Type-Options: nosniff asks browsers not to reinterpret declared MIME types.
Referrer-Policy governs referrer information sent with requests, and Permissions-Policy can restrict access to selected browser features. HSTS is transport-focused and is only meaningful when served over HTTPS.
Use the result as a configuration review, not a penetration test
A header checker is useful after CDN changes, framework upgrades, reverse-proxy migrations or security hardening because headers can disappear at the edge even when application configuration looks correct.
It is not a vulnerability scanner. Authentication flaws, insecure APIs, exposed secrets, dependency vulnerabilities and application logic require separate security testing.