What does securityheaders.com actually check?

securityheaders.com makes a single request to your home page and grades the HTTP response headers it gets back, from A+ down to F. It looks for 6 specific headers:

• Strict-Transport-Security - forces HTTPS
• Content-Security-Policy - controls what the page may load
• X-Content-Type-Options - stops content-type guessing
• X-Frame-Options - blocks clickjacking via embedded frames
• Referrer-Policy - limits what the browser leaks to other sites
• Permissions-Policy - switches off browser features like camera and location

That is the entire scope - one page, response headers only. 81% of Australian small business websites have no Referrer-Policy header.^* Each missing header is usually a 1-line fix at the hosting or CDN layer.