XF 2.2 Low security score

[NealC]

I ran my site and then the XF community site on the page below and it outlines security issues. Is this something that needs attention?

WebPageTest

View this on WebPageTest.org...

www.webpagetest.org

 

[Kirby]

CSP
You are running advertising, so setting up a restrictive CSP is ... challenging at best and nearly impossible otherwise.
But even a pretty permissive CSP will make WPT happy, though IMHO it won't improve security that much - if you really want this for security you'd have to implement a strict CSP.

HSTS
You can and should setup HSTS.

X-XSS-Protection
X-Xss-Protection can be morleess be safely ignored; most browsers have dropped support for this as it caused more harm than it did any good - currently only IE (does anyone really care?) and Safari do support this header.