Which security headers is your site missing?

HeaderFox requests one page, reads the response headers and explains each gap with the line to add. It doesn't download the page or scan anything else.

Only public sites on ports 80 and 443 are checked. Private and internal addresses are refused. Headers can differ between pages; this checks the address you enter, after redirects.