Conversation

HTTP Security Headers Check securityheaders.io -- finally. This should be added to

ssltest.

Replying to

HPKP and STS are foot guns, CSP is great but has no obvious best candidate imo, the others I don't know much about.

Replying to

Reminds me of early ssltest that gave impossibly awful grades to self signed certs [when there were no free certs yet].