There are plenty of tools that will happily tell you that your normal website is terrible.

MDN HTTP Observatory will inspect your HTTP security configuration. SecurityHeaders will judge your headers.