I don't buy your observation that all big-corps are kind of equally sloppy security-wise. Here are 2 examples: - Equifax login form does not use STS header.

I don't buy your observation that all big-corps are kind of equally sloppy security-wise. Here are 2 examples: - Equifax login form does not use STS header. - equifax.com/business exposes full server version (Server:Apache/2.4.27 (Win64) OpenSSL/1.1.0f mod_log_rotate/1.0.0) I'm not a security person but those 2 seems way out of industry standards for security-aware web services.