Grade your security headers.

Run curl -I https://yoursite.com (or copy Response Headers from dev tools) and paste them below. You get a grade, what's present, weak, or missing — and the exact headers to add.

The cheapest security you're not shipping

Security headers are close to free — a few lines in your reverse proxy — and they shut down whole classes of attack: protocol downgrades, clickjacking, MIME confusion, and a big slice of XSS. On a managed platform some of these came set by default. On a box you own, they're yours to add, and they're the first thing a security review checks. This grades what you've got and hands you the rest.

The hard part isn't setting them once; it's keeping them set across every service and deploy, and noticing when a config change quietly drops one. That drift — security that was there last month and isn't now — is exactly what a control plane is built to catch and prove.