Thanks for this - has some useful info, and I will be implementing a couple of missing header details on my site.

But, overall the security scan gives a lot of fails, when in reality I don't think it would know this.

For example

SQL/NoSQL injection protection

How would you know how it is handled?