Credibility · 22 points
Response headers
One check, stated three ways: what we measure, what would make it wrong, and how to confirm it yourself.
What this measures
Presence of Strict-Transport-Security, a Content-Security-Policy, X-Content-Type-Options: nosniff, and a frame control (X-Frame-Options or CSP frame-ancestors) on the page response.
Where this check can be wrong
Presence is the finding, not quality: a CSP full of unsafe-inline earns its point here while still leaving you exposed. Report-Only policies count as present, which is generous.
Verify it without taking our word for it
curl -sI https://your.site | grep -iE 'strict-transport|content-security|x-frame|x-content-type'. Then run securityheaders.com on the same URL for a graded view.