zap-baseline.conf

# zap-baseline rule configuration file
# change FAIL to IGNORE to ignore rule or FAIL to fail if rule matches
# only the rule identifiers are used - the names are just for info
10010	FAIL	(Cookie No HttpOnly Flag)
10011	FAIL	(Cookie Without Secure Flag)
10012	IGNORE	(Password Autocomplete in browser)
10016	FAIL	(Web Browser XSS Protection Not Enabled)
10017	FAIL	(Cross-Domain JavaScript Source File Inclusion)
10019	FAIL	(Content-Type Header Missing)
10020	FAIL	(X-Frame-Options Header Not Set)
10021	FAIL	(X-Content-Type-Options Header Missing)
10034	FAIL	(Heartbleed OpenSSL Vulnerability (Indicative))
10035	FAIL	(Strict-Transport-Security Header Not Set)
10038	FAIL	(Content Security Policy (CSP) Header Not Set)
10040	FAIL	(Secure Pages Include Mixed Content)
10052	FAIL	(X-ChromeLogger-Data (XCOLD) Header Information Leak)
10098	FAIL	(Cross-Domain Misconfiguration)
40014	FAIL	(Absence of Anti-CSRF Tokens)