{
  "ok": true,
  "url": "https://yoursite.com/",
  "final_url": "https://yoursite.com/",
  "status": 200,
  "score": 1,
  "max_score": 9,
  "good": [
    "No version-disclosing Server/X-Powered-By header."
  ],
  "issues": [
    {
      "header": "Strict-Transport-Security",
      "problem": "missing — browsers will accept plain HTTP for this host on the next visit unless something else forces HTTPS."
    },
    {
      "header": "Content-Security-Policy",
      "problem": "missing — no browser-enforced restriction on which scripts/styles/frames can run, so a single injection bug can execute arbitrary script."
    },
    {
      "header": "X-Content-Type-Options",
      "problem": "missing or not 'nosniff' — browsers may MIME-sniff responses, letting a mis-typed upload be executed as script/HTML."
    },
    {
      "header": "X-Frame-Options / CSP frame-ancestors",
      "problem": "missing — this page can be embedded in an <iframe> on any other site, enabling clickjacking."
    },
    {
      "header": "Referrer-Policy",
      "problem": "missing — browser default varies; set explicitly (e.g. 'strict-origin-when-cross-origin') to control what leaks to third-party links."
    },
    {
      "header": "Permissions-Policy",
      "problem": "missing — no explicit restriction on camera/mic/geolocation/etc. for embedded content."
    }
  ],
  "note": "Root response headers only. Cookie flag audit, HTTP->HTTPS redirect check, and fix snippets are in the paid /report.",
  "embed": {
    "svg_url": "https://secheaders.sebastiaan-ba3.workers.dev/badge.svg?url=https%3A%2F%2Fyoursite.com%2F",
    "markdown": "[![secheaders](https://secheaders.sebastiaan-ba3.workers.dev/badge.svg?url=https%3A%2F%2Fyoursite.com%2F)](https://secheaders.sebastiaan-ba3.workers.dev/?url=https%3A%2F%2Fyoursite.com%2F)",
    "html": "<a href=\"https://secheaders.sebastiaan-ba3.workers.dev/?url=https%3A%2F%2Fyoursite.com%2F\"><img src=\"https://secheaders.sebastiaan-ba3.workers.dev/badge.svg?url=https%3A%2F%2Fyoursite.com%2F\" alt=\"secheaders grade\"></a>",
    "note": "Free, no signup, no quota -- embed this in a README or site footer. Re-fetches live on every image load, so the badge always reflects the current headers."
  }
}