Security headers

Lines your server adds to each response that turn on browser protections: always use HTTPS, don't guess file types, don't let other sites frame this page, don't leak the full address when linking out. They take minutes to add.

No app needs to do without them, and none of them will appear unless someone asks, because the app works the same without them. That also makes them easy to check, with one curl.