HTTP security headers audit — up to 5 URLs

- Check each supplied public HTTPS URL and report the actual returned HTTP security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - For each header: present / missing, and a one-line plain-English note on what it protects against - Include the raw header values captured at retrieval time, with the retrieval date - Score each URL 0-10 and list the top 3 highest-impact missing headers to fix - Public GET only; no logins, no payloads, no scanning beyond the listed URLs - Deliver as a self-contained HTML or Markdown report