Check security headers for a list of websites in Python: HSTS, CSP, X-Frame-Options and an A-F grade (2026)

A ~75-line standard-library Python script that fetches a list of URLs, follows redirects by hand, scores HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy and cookie flags, and writes an A-F graded CSV. 10 sites in 0.4 s.