Great tool. Some feedback: - The section on FLOC is a bit inaccurate; I wrote about what the interest-cohort permis. policy does and doesn't do: https://seird

Great tool. Some feedback: - The section on FLOC is a bit inaccurate; I wrote about what the interest-cohort permis. policy does and doesn't do: https://seirdy.one/2021/04/16/permissions-policy-floc-misinfo.html https://seirdy.one/2021/04/16/permissions-policy-floc-misinf... - Safari now supports normal icons for pinned tabs. apple.com no longer uses a mask-icon. - X-XSS-PROTECTION should be set to 0 (disable) according to OWASP's latest guidelines, since XSS filtering has been found to introduce new sec vulns: https://owasp.org/www-project-secure-headers/#x-xss-protection https://owasp.org/www-project-secure-headers/#x-xss-protecti... - Some implementations of HSTS and auto HTTPS upgrades mandate that HTTP-to-HTTPS redirects don't change the hostname, including the www prefix. If anything, this tool should recommend against a single redirect for HTTP->HTTPS upgrades and www subdomain prefixing/removal. - Very, very few browsers do support X-Frame-Options but lack support for CSP; even fewer have a modern TLS stack that works with secure cipher suites. X-Frame-Options no longer should be needed since the CSP header fills its use case. I'd recommend taking a look at some existing checkers for reference. Webbkoll, check-your-website.server-daten.de, Hardenize, Lighthouse, and Webhint.io are some good ones.