[Feature request] check CSP header about ssllabs-scan HOT 6 CLOSED

I don't think it should be required to support CSP to get A+ because no CSP doesn't necessarily mean mixed content exists, and it's better not to embed any insecure resources in the first place.

from ssllabs-scan.

Testing port 80 should not be part of this. There are plenty of valid reasons why port 80 may be available and serving content.

Likewise CSP should not be a requirement, as its absence is indicative of nothing substantial.

from ssllabs-scan.

The only thing we could add about CSP is to detect if the server uses it to prevent third-party mixed content. Everything else is out of scope.

from ssllabs-scan.

Out of scope, at least for the time being.

from ssllabs-scan.

You may also note the 'Upgrade Insecure Requests' feature (part of CSP), that is already detected in the client test.

from ssllabs-scan.

See https://securityheaders.io/

from ssllabs-scan.