IE 10→ [score] 14/17 [postMessage] yes [JSON.parse] yes [toStaticHTML] yes [httpOnly cookies] yes [X-Frame-Options] yes [X-Content-Type-Options] yes [Block location spoofing] yes [Block JSON hijacking] yes [Block XSS in CSS] yes [Sandbox attribute] yes [Origin header] no [Strict Transport Security] no yes [Cross Origin Resource Sharing] yes [Block visited link sniffing] yes [Content Security Policy] no [# Tests] 1273 [Block reflected XSS] 
yes