HTTPS persistence
HSTS is useful after HTTPS is reliably deployed. A long max-age should not be enabled casually on hosts or subdomains that cannot stay on HTTPS.
Website security
Inspect HTTP security headers in context.
See the headers a browser actually receives and separate recommended defenses from optional or obsolete controls.
Result
Website security observations
What to review
Read the finding in context.
Clickjacking defense
CSP frame-ancestors is the modern control; X-Frame-Options DENY or SAMEORIGIN remains a useful compatibility signal.
Avoid obsolete “security” headers
Expect-CT is obsolete and enabling old X-XSS-Protection modes is not treated as a security improvement.
Server information
Server and framework version headers are reported as information disclosure signals rather than proof of compromise.