battle of the blogs

blogs.txt

$ httpobs garron.net
Score: 45 [D+]
Modifiers:
    [  +5] Preloaded via the HTTP Strict Transport Security (HSTS) preloading process
    [  -5] X-Content-Type-Options header not implemented
    [ -10] X-XSS-Protection header not implemented
    [ -20] X-Frame-Options (XFO) header not implemented
    [ -25] Content Security Policy (CSP) header not implemented

$ httpobs pokeinthe.io
Score: 110 [A+]
Modifiers:
    [  +5] Content Security Policy (CSP) implemented with default-src 'none' and no 'unsafe'
    [  +5] X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive