{
  "url": "http://example.com/",
  "method": "GET",
  "hops": [
    {
      "url": "http://example.com/",
      "method": "GET",
      "addr": "172.66.147.243:80",
      "status": 200,
      "status_text": "OK",
      "proto": "HTTP/1.1",
      "content_type": "text/html; charset=utf-8",
      "content_encoding": "br",
      "headers": [
        {
          "name": "Age",
          "value": "7"
        },
        {
          "name": "Allow",
          "value": "GET, HEAD"
        },
        {
          "name": "Alt-Svc",
          "value": "h3=\":443\"; ma=86400"
        },
        {
          "name": "Cf-Cache-Status",
          "value": "HIT"
        },
        {
          "name": "Cf-Ray",
          "value": "a523b59c18df9427-LHR"
        },
        {
          "name": "Content-Encoding",
          "value": "br"
        },
        {
          "name": "Content-Type",
          "value": "text/html; charset=utf-8"
        },
        {
          "name": "Date",
          "value": "Thu, 29 Oct 2026 16:55:42 GMT"
        },
        {
          "name": "Last-Modified",
          "value": "Thu, 29 Oct 2026 13:15:03 GMT"
        },
        {
          "name": "Server",
          "value": "cloudflare"
        }
      ],
      "timing": [
        {
          "name": "dns",
          "ms": 18.278
        },
        {
          "name": "connect",
          "ms": 10.722
        },
        {
          "name": "tls",
          "ms": 0
        },
        {
          "name": "ttfb",
          "ms": 24.913
        },
        {
          "name": "download",
          "ms": 0.095
        }
      ],
      "total_ms": 54.392,
      "total": "54 ms",
      "body_bytes": 334
    }
  ],
  "redirects": 0,
  "total_ms": 54.392,
  "total": "54 ms",
  "proto": "HTTP/1.1",
  "http3_advertised": true,
  "compression": "br",
  "grade": "F",
  "checks": [
    {
      "name": "Strict-Transport-Security",
      "status": "info",
      "note": "Not applicable: the final response came over plain HTTP, and browsers ignore HSTS on insecure responses.",
      "guide": "https://kirkdiamond.com/guides/hsts-preload-checklist"
    },
    {
      "name": "Content-Security-Policy",
      "status": "fail",
      "value": "missing",
      "note": "A CSP is the main defence against cross-site scripting. It tells the browser which scripts, styles, frames and connections are allowed, so an injected script has nowhere to run.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Framing",
      "status": "fail",
      "value": "missing",
      "note": "Any site can load this page inside an invisible iframe and trick a user into clicking on it. Add Content-Security-Policy: frame-ancestors 'self' or X-Frame-Options: DENY.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "X-Content-Type-Options",
      "status": "fail",
      "value": "missing",
      "note": "Without nosniff a browser may sniff a file's type and run something as JavaScript that was never meant to be. One header, no downside.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Referrer-Policy",
      "status": "warn",
      "value": "missing",
      "note": "Browsers default to strict-origin-when-cross-origin now, which is sensible, but setting it explicitly removes the guesswork for older clients.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Permissions-Policy",
      "status": "warn",
      "value": "missing",
      "note": "Optional but recommended. Turning off features the page does not need (camera=(), microphone=(), geolocation=()) limits what a compromised script or third-party frame can do.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Cross-Origin-Opener-Policy",
      "status": "info",
      "value": "missing",
      "note": "Not essential for most sites. same-origin is worth adding if the page handles logins or sensitive data.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Server disclosure",
      "status": "pass",
      "value": "Server: cloudflare",
      "note": "A product name without a version is fine."
    },
    {
      "name": "Cookies",
      "status": "info",
      "value": "none set",
      "note": "No Set-Cookie headers in the chain, so nothing to audit.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    }
  ]
}