Signals worth inspecting
Strict-Transport-Security helps browsers keep using HTTPS. Content-Security-Policy limits what browsers may load and execute, when correctly tuned. X-Content-Type-Options: nosniff reduces certain content-type interpretation risks. Referrer-Policy controls some referral information shared during navigation.
A missing header isn't a breach
Each signal has a different risk profile. Some sites use equivalent controls in application architecture; other sites need careful testing before turning a header on. For example, deploying a strict CSP without measuring required scripts and styles can break production features.
Keep crawl status separate
A 200 response, readable HTML, robots.txt and valid sitemap are useful search foundations, but they don't establish that search providers indexed the page. JavaScript-only content may also need a rendering-specific review.
SiteProbeLab does not scan ports, authenticate, attempt exploits, brute-force endpoints, or claim to perform penetration testing. Never treat a clean result as proof of safety.
Use the limited check responsibly
Submit the site's public root domain to the live website audit and export the prioritized findings. Have someone familiar with your infrastructure review changes before rollout.