给 HTTP 响应头的安全性打分，还附修复建议。 你的数据不会离开此浏览器。
安全评级
基于现有标头及其值。
良好Strict-Transport-Security
max-age=63072000; includeSubDomains
Recommended: max-age of at least 15552000, includeSubDomains, preload
风险Content-Security-Policy
Add a restrictive policy, e.g. default-src 'self'
良好X-Frame-Options / frame-ancestors
SAMEORIGIN
Use DENY/SAMEORIGIN or CSP frame-ancestors to prevent clickjacking
良好X-Content-Type-Options
nosniff
Recommended: nosniff
风险Referrer-Policy
Recommended: strict-origin-when-cross-origin
风险Permissions-Policy
Restrict powerful features, e.g. geolocation=(), camera=()
风险Cross-Origin-Opener-Policy
Recommended: same-origin
风险Server / X-Powered-By
nginx
Reveals software details; consider removing or genericizing