What this tool shows
OrbitProbe requests the home page over HTTPS, follows redirects and lists the headers of the final response exactly as the server sent them. Headers are how a server tells browsers and caches what to do: how long to keep a copy, whether the page may be framed, which scripts may run, and that the site must only be reached over HTTPS.
Cookie values are never displayed. A Set-Cookie header can carry a session identifier, so only the cookie name and its attributes (Secure, HttpOnly, SameSite, expiry) are shown. Those attributes are the part worth reviewing anyway.
The security headers, briefly
Strict-Transport-Security tells returning browsers to use HTTPS only. Content-Security-Policy restricts where scripts, styles and frames may load from, which limits the damage of an injected script. X-Content-Type-Options: nosniff stops browsers from guessing file types. X-Frame-Options, or the frame-ancestors directive in CSP, controls whether other sites may embed the page. Referrer-Policy and Permissions-Policy limit what the page leaks and which device features it may use.
The tool checks whether each header is present on this one response. It does not grade the policy inside it: a Content-Security-Policy that allows everything is present, and useless. Read the value.
Doing it from a terminal
curl -sI https://example.com shows the headers of a single response, and curl -sIL follows redirects and prints the headers of every hop. Browser developer tools show the same under the Network tab.