Reading the result
The path should end in one HTTPS page after at most a couple of redirects. A plain http address that goes straight to https is what you want, and a long chain of redirects slows every first visit.
- strict-transport-security tells browsers to use HTTPS only once they have seen it.
- content-security-policy limits where scripts and other content may load from, and is the hardest to set up well.
- x-content-type-options stops browsers guessing file types.
- x-frame-options blocks other sites from framing yours. A content security policy can do the same job.
- referrer-policy and permissions-policy control what is shared and which browser features are on.
A missing header is a prompt to look, not always a fault. Many hosts let you add these in a settings page or a configuration file. We make one request from our server and read only the headers.