I'm not challenging your assessment of the website
Post# of 40989
Disclaimer
HTTP security is only one piece in the large puzzle of web app security. The score presented here is not necessarily representative of the websites' general status of security. A low score does not translate directly into the website being insecure, and vice versa.
Any metric assigned to security state, HTTP or otherwise, is subjective and debatable. Don't get hung up on the exact score. Use the results to find the appropriate level of protection for your website.