Sends a HEAD or GET request from your browser and lists the response headers JavaScript can read: every header for same-origin URLs, and cross-origin only the CORS-safelisted ones (Cache-Control, Content-Type, Content-Length, Expires, Last-Modified, Pragma, Content-Language) plus whatever the server exposes — the report says which case applies instead of guessing. Same-origin responses get a security-header grade (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP, Cache-Control) with concrete fixes; version-revealing and deprecated headers are flagged. The request headers your browser adds are listed, and a curl command gives the complete set from a terminal.