Recommended security headers with safe presets, never sent twice, plus a read-only self-check that explains what your site really sends.