What the report includes
- Valid HTTPS and the redirect.
- HSTS, CSP, nosniff, framing protection and Referrer-Policy.
- A short list of commonly exposed files if they open in public.
How to read it
A missing header is a configuration gap, not proof of a breach. The full explanation and the fix steps are in the paid report.