TLS scan configuration
Advanced things like "skip
", "yes, we want the self-signed cert here", and the ability to ignore specific kinds of problems (particular headers, etc).
Good header list to consider in default config:
Access-Control-Allow-Origin
Cache-Control
Content-Security-Policy
Expires
HTTP Strict-Transport-Security
Set-Cookie
X-Content-Type-Options
X-Frame-Options (Frame-Options)
X-XSS-Protection