How does the header checker work?

It issues one limited HTTP request to read the response headers of the target URL (http/https only, port 80/443, 6-second timeout, no redirects, private/loopback hosts blocked). It executes no JavaScript and performs no scanning.

Which headers are checked?

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and X-Content-Type-Options — the defensive baseline.

Security Header Checker — Audit a Site

What this checks

Content-Security-Policy — mitigates XSS and injection.
Strict-Transport-Security — forces HTTPS.
X-Frame-Options — prevents clickjacking/embedding.
X-Content-Type-Options — prevents MIME sniffing.

Caveats: the score is based on a single response-header probe; CDN/edge variations and JavaScript-executed behaviour are not captured.

Related Knowledge

Application Security — security headers in context.
Browser Security — how misconfigured headers weaken the browser.