Security headers check
Seven headers that cost nothing to add and stop most of what gets done to small sites.
Headers are the cheapest security you can buy
They are lines of configuration. No software to install, no subscription, no performance cost. Content-Security-Policy is the difference between an injected script running and an injected script being blocked; HSTS is the difference between a first visit that can be intercepted and one that cannot.
They are also the most commonly skipped, because nothing visibly breaks when they are missing. A site with none of them looks and behaves exactly like a site with all of them, right up until it does not.
What each grade means
The grade weights the headers that stop a real attack — HSTS, CSP, clickjacking protection and nosniff — above the ones that are good practice. A site can reach a B with nothing exotic configured, and most small business sites currently sit at an F because nobody has ever added a line.
Content-Security-Policy is the one that takes real work. Written badly it breaks your own scripts, which is why so many sites either skip it or weaken it with unsafe-inline until it stops blocking anything. A CSP with unsafe-inline is still better than none, and this check says so rather than failing you outright.
One page, not the whole site
Headers are read from your home page. A page behind a login, on a subdomain, or served by a different application can be configured entirely differently — a WordPress site with a separate shop, for instance, often has two sets of rules.
If the home page grades well, check one page from each distinct part of the site before assuming the rest matches.