# privacyheaderpulse report: https://demo-store.example/

> Demo report on a fictional sample site.

**Score:** 19/100 · Scanned 2026-10-26T19:46:20.731Z

8 of 9 checks need attention (1 high priority).

- [x] **Served over HTTPS** (high): https://demo-store.example/
- [ ] **Strict-Transport-Security (HSTS)** (high): Missing.
- [ ] **Content-Security-Policy** (medium): Missing.
- [ ] **Clickjacking protection** (medium): Missing.
- [ ] **X-Content-Type-Options: nosniff** (low): Missing.
- [ ] **Referrer-Policy** (low): Missing: full URLs may leak to other sites.
- [ ] **Permissions-Policy** (low): Missing.
- [ ] **Cookies use Secure and SameSite** (medium): Weak: session
- [ ] **No server version disclosure** (low): nginx/1.18.0 / PHP/7.4

---
One read-only page request. Headers can differ per page and per CDN rule.