What your site tells a stranger before it renders a single pixel

Type a domain, hit enter, and before anything paints, your server and the browser have already had a short conversation. The server sends back response headers — and to anyone who knows how to read them, those headers are a fairly candid statement about how seriously that site takes its own security. Attackers read them first. Not because headers...