Yeah, −60 for lacking Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection is grossly excessive. As is declaring XFO “mandatory for all new websites, and all existing websites are expected to add support for [it] as soon as possible” <https://infosec.mozilla.org/guidelines/web_security#x-frame-...>. XFO is entirely unnecessary for stateless and actionless websites, CSP of no value on static sites that load no third-party resources, and the rest of them of no value on static sites. You could say they protect against man-in-the-middle attacks or attacks on your static file server (nginx or equivalent), but any competent MITM will modify headers, and with attacks on the static file server you’re hosed anyway. I also think they should significantly downgrade at least XFO (they last touched that descriptive document I quoted over three years ago), because the browsers that want it are all now obsolete (IE11 being the only one that’s even vaguely still in use) and entirely unsupported by many systems.

I get 40⁄100, D⁺, because of this stuff, and I have not the slightest intention of changing it because I’m stubborn and know that I don’t need them. Well, it’s better than the 0⁄100 it gave me at the start of 2019, or the 20⁄100 back in 2016.

It needs some sort of profile system for the rankings, so that you can say “anything”, “static site”, “static site with no third-party resources”, that sort of thing, and in the lattermost case have it say “OK, then we’ll just suggest CSP, XCTO, XFO and XXP rather than screaming about them”.

To be fair, you don’t need JS in the exploited website to do XSS.

Some of those headers are deprecated anyways and people should be using Content Security Policy. It's silly to subtract points for not using a deprecated header.

same here. I don't think this tool was designed for our use case