Skip to content

TLS scan configuration

Advanced things like "skip", "yes, we want the self-signed cert here", and the ability to ignore specific kinds of problems (particular headers, etc).

Good header list to consider in default config:

  • Access-Control-Allow-Origin
  • Cache-Control
  • Content-Security-Policy
  • Expires
  • HTTP Strict-Transport-Security
  • Set-Cookie
  • X-Content-Type-Options
  • X-Frame-Options (Frame-Options)
  • X-XSS-Protection