Every security tool should have to eat its own cooking, in public, with the numbers attached. So here is ours. We ran AuditMerlin on lverbeeck.com, our founder's own portfolio site, published what it found, fixed it while watching the clock, and left one finding deliberately unfixed. The site is a static site behind Cloudflare, which is the kind of setup people assume is already fine. It scored 73.

The baseline: 73 out of 100, grade C

Four findings, and all four were the same species: response headers the site was not sending. No exposed files, no certificate problems, no version disclosure, HTTPS redirect already enforced. That is the normal shape of a small-site result. Nothing dramatic is on fire; several free wins are sitting untouched.

Fixes one and two: 82, grade B

First X-Frame-Options, which stops another site from loading yours inside an invisible frame and harvesting your visitors' clicks. Then Permissions-Policy, which switches off the browser features the site never uses, so camera, microphone and geolocation are unavailable to anything that ever gets injected into a page.

Both went on through AuditMerlin's one-click Cloudflare integration, which writes the header at the edge instead of in the site's code. Re-scan: 82, grade B.

Fix three: 91, grade A

Then HSTS, which tells browsers never to talk to the domain over plain HTTP again and closes the gap that SSL stripping attacks live in. We applied it with a six-month max-age and deliberately without the preload flag.

That is a considered choice, not a shortcut. Preload bakes your domain into the list browsers ship with, which is effectively permanent and slow to undo if anything about your HTTPS setup ever changes. Six months without preload gives returning visitors real protection and stays reversible. Re-scan: 91, grade A.

The receipt

  • Three clicks.
  • About two minutes, start to finish.
  • Zero lines of code deployed.
  • Zero downtime, no server access, no plugin installed.

None of that is magic. It is what happens when a static site sits behind a CDN and the headers get set in the one place that can serve them for every request.

The red mark we left alone

The site still shows one failing check: Content-Security-Policy. AuditMerlin refuses to apply that one for you, on any plan, and the report says so on the finding itself along with the reason.

A blanket CSP breaks real sites. It breaks page builders that inline their scripts and styles, and it breaks checkouts whose payment scripts are not on the list. The damage lands instantly and it usually lands on the part of the site that makes money. So CSP gets guidance and a report-only rollout path instead of a switch, and the score stays honest about it.

Which means our own site sits at A, not 100, with one explained limitation on the page. We think that is the right trade. Any tool that can take you to a perfect score in one click is a tool willing to push a blanket policy onto a live site, and that is somebody else's revenue it is gambling with.

What this means for your site

If you are behind Cloudflare, most of the distance between a C and an A is header configuration, not a rebuild, and it is measured in minutes. The useful first step is simply knowing which of them you are missing and what each one actually protects.

Run a free scan on your own site. Fifteen checks, every finding linked to the OWASP or Mozilla guidance behind it, and a plain statement of what the report is: a technical security audit, not a compliance certificate. If your number comes back looking like our 73 did, the good news is you now know exactly where the missing points are.