security
is it safe to visit
Three things stand between a visitor and somebody interfering with them. All three are settings, none of them cost anything, and most sites have at least one switched off.
About this check
·Encryption is the floor, not the ceiling
A padlock means the connection is private. It says nothing about what the server does once the page arrives — which headers it sends, which it leaves out, and what it mentions about itself along the way. A site can hold a perfect certificate and still hand the browser no instructions at all.
·Headers cost nothing and almost nobody sends them
A Content-Security-Policy, a frame rule and a referrer rule are three lines of server configuration. They are the difference between a page that can be framed, injected into and leaked from, and one that cannot. They are free, they break nothing when set carefully, and the check tells you the exact line to send.
·What a server mentions about itself
Version headers name the software you run and its release. That is a starting point for anyone looking for a known weakness in that exact version. Cookies without the right flags can be read where they should not be. Neither is dramatic on its own; both are free to close.