Defensive security checks, each with a concrete fix attached: security headers, CSP policy analysis, cookie flags, HSTS configuration, CORS behavior and password strength. Informational and safe to run against any site you operate.
A sensible order for hardening a site: run the Security Headers Checker first for the overview, fix HSTS (one line), then work through cookies and CSP — the two that need actual thought.