Which security headers does this site send?

Set with a max-age of 31536000 seconds. After a browser sees this once, it will use HTTPS for this host for that long without trying plain HTTP first. includeSubDomains extends it to every subdomain.

Set, but it contains 'unsafe-inline'. 'unsafe-inline' permits inline <script> and style attributes, which is exactly the vector CSP is usually deployed to block. The policy still constrains where external resources load from, but its protection against injected script is much weaker than the header's presence suggests.

Set to SAMEORIGIN, so these pages may be framed by this site but not by any other one.

Set to nosniff, so the browser takes each response's declared Content-Type at face value instead of inspecting the bytes and deciding for itself.

Not set. Setting it would control how much of the current URL is sent to other sites when a visitor follows a link. Current browsers already default to strict-origin-when-cross-origin, so the absence is far less exposing than it once was.

Not set. Setting it would let you switch off browser features this site does not use — camera, microphone, geolocation and the rest — for the page and anything it embeds, so injected or third-party code cannot ask for them.