Adding a Content Security Policy of “upgrade-insecure-requests”. It does nothing meaningful for your security, but it’s enough to satisfy a bunch of these scan

Adding a Content Security Policy of “upgrade-insecure-requests”. It does nothing meaningful for your security, but it’s enough to satisfy a bunch of these scanning tools that giving you a letter grade. Yes, we want to add a robust CSP, but we currently have some limitations/requirements that make implementation more challenging.