Defensive security checks, each with a concrete fix attached: security headers, CSP policy analysis, cookie flags, HSTS configuration, CORS behavior and password strength. Informational and safe to run against any site you operate.
A sensible order for hardening a site: run the Security Headers Checker first for the overview, fix HSTS (one line), then work through cookies and CSP: the two that need actual thought.
These are informational checks, not a penetration test. Each one reads what a server voluntarily returns to an ordinary request, in the same way any visitor's browser does, and none of them attempts to exploit anything or to authenticate as anybody. That makes them safe to run against a site you operate and safe against one you do not, and it also sets the limit: they can tell you a header is missing or a cookie is unprotected, and they cannot tell you whether the application behind it is secure.