To be a brief Devil's advocate: I can sort of see the OPs point from a layman's point of view. If a security expert cannot (I use "cannot" here from the layman'

To be a brief Devil's advocate: I can sort of see the OPs point from a layman's point of view. If a security expert cannot (I use "cannot" here from the layman's point) secure the website (According to a tool that shows scary red X's) then what chance does a mere mortal have, or is it that important? Now, we know that spending the time securing a personal blog the whole nine yards is probably not worth it; but to an uninformed person who cannot make that judgement? Black and White is so much easier than greyscale. This is why I usually go all or nothing in this kind of situation. Of course doing nothing would probably have resulted in a "His site isn't even https!". Damned if you do and damned if you don't. At least take solace in the fact that the comment has been judged appropriately and you have admirers correcting the superficial opinion.