Free tool
Security header check
Which protective headers your site sends, which it is missing, and the one line that fixes each. No sign-up, nothing stored.
Why this is not a score
Plenty of tools give a letter grade, and the grade encourages chasing every header rather than the ones that matter. For a brochure site with no login, two of these do almost all the useful work and the rest are tidying. A site that takes payments or holds accounts needs the lot.
Every missing header below comes with the exact line that adds it. Where you put that line depends on your host — most control panels have a custom headers box, WordPress has plugins for it, and on Cloudflare it is a Transform Rule. If none of that means anything to you, the answer is to send this page to whoever runs your site.
A missing header is not a break-in. It is a door left unlocked in a building nobody has tried yet. Worth locking, not worth panicking about.