Six response headers every browser and security scanner checks for. They are set once at the server and cost nothing to add. Anyone can verify this list in about ten seconds with curl.
✓
Strict-Transport-Security
Tells browsers to only ever connect over HTTPS, so a link that starts as http is upgraded before anything is sent.
Present
✓
Content-Security-Policy
Tells the browser which scripts and styles are allowed to run, which is the main defence against injected code.
Present
✓
X-Content-Type-Options
Stops the browser guessing a file type, which is how a harmless upload can end up executed as a script.
Present
✓
X-Frame-Options
Stops other sites embedding your pages in a hidden frame to capture clicks meant for you.
Present
✕
Referrer-Policy
Controls how much of your URL is handed to the next site a visitor clicks through to.
Absent
✓
Permissions-Policy
Declares which browser features, camera, microphone, location, the page is allowed to ask for.
Present
Performance, SEO and accessibility
Measured with Google Lighthouse on a mobile connection. These four are Google's own categories and anyone can reproduce them.
Performance
59/100
How quickly the page becomes usable on a phone, which is where most local searches happen.
SEO
100/100
Whether search engines can read what this business does and where it does it.
Accessibility
87/100
Whether someone using a screen reader or a keyboard can get through the site.
Best Practices
100/100
Errors and insecure requests a modern browser flags behind the scenes.
The specific shortfalls
Performance Largest Contentful Paint 19.2 s
Performance First Contentful Paint 4.4 s
Performance Speed Index 8.2 s
Accessibility Elements with `role="dialog"` or `role="alertdialog"` do not have accessible names.
Accessibility Background and foreground colors do not have a sufficient contrast ratio.
Accessibility Links do not have a discernible name
Accessibility Heading elements are not in a sequentially-descending order
Want these fixed, not just flagged?
We rebuild sites clean, and we do not stop until every category comes back green, including all six security headers, or your money back. You own everything, no lock-in.
We measure a public website only. This says nothing about how Sullivan & Cromwell handles data internally, and nothing here is a statement about any incident. Headers were read with a single request following redirects on September 1, 2026.