Inspect remote response headers, audit security headers (CSP, HSTS, X-Frame), follow redirect chains, and check server latency with SSRF guard.