content-security-policy

Content Security Policy (CSP) header not implemented

cookies

Cookies set without using the Secure flag, but transmission over HTTP prevented by HSTS

Content is not visible via cross-origin resource sharing (CORS) files or headers

Initial redirection is to HTTPS on same host, final destination is HTTPS

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

Subresource Integrity (SRI) is not needed since site contains no script tags

X-Content-Type-Options header set to "nosniff"

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

Deprecated X-XSS-Protection header not implemented

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-5		OWASP Session Management Cheat Sheet.