Yes, I am using an apache webserver. mod_rewrite is enabled. If I go to http://yoursite.com/vendor/autoload.php the following 403 Error occures:

1. Request-URL:
   http://192.168.56.102/vendor/autoload.php
2. Request method:
   GET
3. Statuscode:
   403 Forbidden
4. Remote-Address:
   192.168.56.102:80

So the hardening does work (yay!!), it's just the detection that isn't working.

Any errors in the webservers/php error log?

Maybe there is a firewall rule on your webserver which prevents it from checking the hardening rules?

The page does a curl call to the autoload.php file and checks if the response is 403. If a firewall would prevent the 'outgoing' call the response wouldn't be 403, thus no check mark.

I also thought it could be an SSL verification issue, but in your example I see the website doesn't run on an https site (for internal testing of course ;)

looks like you don't have the PHP module curl enabled. Check your php.ini

@JeromeBakker

Thank you very much for your help!
This tutorial helped me a lot:
https://www.geeksforgeeks.org/how-to-enable-curl-in-php/

Cheers

Christoph