Are you using Qualys? It seems they are having major issues with header checks starting around Oct 1st. Tenable however still passes sites without HPKP. Getting our vendors, like fortinet, to implement all the security headers Qualys now demands will be impossible so we are checking other ASV's to see how they respond to our sites. Just for jollies you should go check pci.qualys.com's security headers.