How to use
What it is
Paste the output of curl -I https://your-site, or the response headers the browser's network tools copy, and it tells you what's missing or wrong: CSP (including when it is report-only or trusts a list of domains), HSTS, cookie flags and prefixes (Secure, HttpOnly, SameSite, __Host-), CORS, COOP, Permissions-Policy and the rest of the usual security headers.
The grade
The letter comes ONLY from how many findings there are of each severity, so you can rebuild it from the list: F with anything critical, D with 3 or more high, C with 1 or 2 high, B with 4 or more warnings, A with 1 to 3 and A+ with none (“info” does not count). Mozilla Observatory gives a different letter by subtracting points per test, and its own documentation admits those weights are arbitrary; here there are no weights to justify.
To generate your own headers
This tool AUDITS what a site is already sending. If you want the nginx or Apache configuration for your own project, use the SPA configuration tool.
How does it know if it's HTTPS?
Response headers don't repeat the request's scheme. If you paste the command line (curl -I https://…) or the bare URL, it's detected from there; with no clue at all, HTTPS is assumed (the most common real case) — and you can correct it by hand with the toggle.
