Security27 rules onwhether your padlock tells the truth.
HTTPS, certificates, security headers and cookies.
HTTPS
- A form declares HTTP submission or sensitive fields appear on HTTPA form with an eligible control declares an action that resolves to http://, or a page served over HTTP contains sensitive input controls.In the report: Pages declare insecure form transport or sensitive controls on HTTP
- A secure address passes through an insecure oneAn HTTPS version of the homepage redirects to an http:// address, or through one on its way.In the report: HTTPS redirects through HTTP
- A secure page names an insecure address as the main oneAn HTTPS page declares an http:// address as its canonical.In the report: HTTPS page canonicalizes to HTTP
- A secure page references active content at http:// addressesAn HTTPS page's raw HTML references a script, stylesheet, frame, object or embed at an http:// address.In the report: Active mixed content
- The http:// version of your site does not redirect to https://A plain-HTTP version of the homepage serves content instead of redirecting to HTTPS.In the report: HTTP does not redirect to HTTPS
- A secure page references images or media at http:// addressesAn HTTPS page's raw HTML references an image, audio, video or media source at an http:// address.In the report: Passive mixed content
- Links and lists still point to http:// addressesInternal links, hreflang or sitemap entries on an HTTPS site still use http:// addresses.In the report: HTTPS pages still reference http:// URLs in links, hreflang or sitemaps
Certificates and TLS
- A TLS certificate could not be verifiedA recorded TLS certificate check failed verification for the site origin or a checked address.In the report: Invalid or expired TLS certificate
- The server accepts TLS 1.0 or TLS 1.1 connectionsA test connection that offered only TLS 1.0 or only TLS 1.1 was accepted by your server.In the report: Server still accepts TLS 1.0 / TLS 1.1 handshakes
- The server accepts an obsolete cipher suiteA certificate-verified test handshake that offered the complete four-suite obsolete set negotiated one of those suites.In the report: Server accepts obsolete cipher suites (RC4 / 3DES / EXPORT / NULL)
- The server does not offer TLS 1.3Your server negotiates TLS 1.2 on ordinary connections and refused a test connection that offered only TLS 1.3.In the report: TLS 1.3 upgrade available — origin tops out at TLS 1.2
HSTS
- HTTPS pages send no HSTS headerSampled HTTPS responses carry no Strict-Transport-Security header.In the report: HTTPS origin serves no Strict-Transport-Security header
- HSTS asks for preloading but fails a checked requirementThe Strict-Transport-Security header asks for preload while one of the checked preload requirements fails.In the report: HSTS preload declared but preload requirements unmet
- HSTS max-age is below one yearThe captured Strict-Transport-Security max-age is below 31,536,000 seconds.In the report: Strict-Transport-Security max-age below one year
Content Security Policy
- A script policy declares unsafe-inline without a nonce, hash or strict-dynamicIn a captured policy, the effective script directive lists 'unsafe-inline' without a nonce, hash or strict-dynamic in that same directive.In the report: CSP allows 'unsafe-inline' scripts without nonce or hash
- Pages have no Content Security PolicyNeither a Content-Security-Policy header nor a matching meta tag was found, on two fetches.In the report: Pages served without any Content-Security-Policy
- A Content Security Policy contains unsafe-evalA captured Content Security Policy lists 'unsafe-eval' for script sources.In the report: CSP allows 'unsafe-eval' in script sources
- A Content Security Policy lacks object or base-address restrictionsA captured Content Security Policy lacks both object-src and its default-src fallback, or omits base-uri.In the report: CSP leaves object-src or base-uri unrestricted
- A Content Security Policy lists broad script or object sourcesA captured Content Security Policy lists *, http:, https: or data: for scripts or objects.In the report: CSP script/object sources allow wildcard or whole-scheme origins
- Report-Only CSP lacks an enforcing response headerA non-empty Content-Security-Policy-Report-Only policy is present without an enforcing Content-Security-Policy response header.In the report: CSP Report-Only header without an enforcing CSP response header
Other headers
- A referrer policy is missing or sends full addressesThe page declares no Referrer-Policy, or one that sends full addresses to other origins.In the report: Referrer-Policy absent or leaks full URLs cross-origin
- Audited HTML pages lack nosniffResponses carry no X-Content-Type-Options: nosniff, on two fetches.In the report: Responses without X-Content-Type-Options: nosniff
- Pages send no framing headersA captured response has neither an X-Frame-Options header nor a Content-Security-Policy frame-ancestors directive in a header.In the report: Pages lack X-Frame-Options and CSP frame-ancestors protection
- No cross-origin isolation headersSampled responses carry none of Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy.In the report: No cross-origin isolation headers (COOP/COEP/CORP) on the origin
- Server headers name software versionsA Server, X-Powered-By or X-AspNet-Version header contains a version number.In the report: Server headers disclose software versions
- X-Frame-Options conflicts with frame-ancestors or is invalid alongside itWhere an enforcing CSP header declares frame-ancestors, captured X-Frame-Options is invalid or disagrees with its resolved framing outcome.In the report: X-Frame-Options and frame-ancestors disagree