Check if a site sends the recommended HTTP security headers.
🔒 We only fetch the response headers (not the page content), once.
