SSL Labs have a great tool for testing and scoring the strength of your ciphers and SSL implementation. I've seen people go to great lengths to get an "A+ score". While it can be a little bit check box security and can end up with cargo cult configurations in Apache …

I've been thinking a lot recently about gamification of security. Giving people scores for how well they do security. Things like getting an "A+" on the SSL Labs or on securityheaders.io test.

Working through Google or Facebook's "Security Checklists" of things like password length and enabling 2 factor authentication …

This week I decided to play around with securityheaders.io and see if I could get an A+ rating.

I already had Public Key Pinning and Strict Transport Security so those two were easy.

Then I added Xss-Protection, but I wasn't sure what exactly it did. After a bit of …