bbc.com
domain Headers C TLS 100 HTTPS 200 TLS 86 dHosted by Fastly (AS54113) · Address 151.101.0.81, 151.101.64.81, 151.101.128.81, 151.101.192.81, 2a04:4e42:400:0:0:0:0:81, 2a04:4e42:600:0:0:0:0:81, 2a04:4e42:0:0:0:0:0:81, 2a04:4e42:200:0:0:0:0:81 · HTTP/2 · 49 ms · Server BBC-GTM · “BBC Home | Breaking News, World News, US News, Sports, Busin...”
Findings
-
Caution Security headers grade C SEC-HEADERS-GRADE
50 / 100 on our rubric
How to fix: Add HSTS, a Content-Security-Policy, nosniff and frame-ancestors; see the Learn guide on security headers.
-
Note No Content-Security-Policy CSP-MISSING
-
Pass Site answers over HTTPS WEB-HTTPS-OK
HTTP 200 in 49 ms
-
Pass Plain HTTP redirects to HTTPS WEB-HTTP-REDIRECTS
https://www.bbc.com/
-
Pass HSTS is enabled HSTS-OK
max-age=31536000; preload
-
Pass TLS score 100 (A) TLS-SCORE
On our published rubric: validity, trust, key, protocols, HSTS.
-
Pass Certificate valid for 86 more days TLS-VALIDITY-OK
2027-01-24T05:46:23+00:00
-
Pass Certificate chain verifies TLS-TRUSTED
GlobalSign nv-sa GlobalSign GCC R46 OV TLS CA 2025
-
Pass TLS 1.3 supported; legacy protocols refused TLS-MODERN
TLSv1.3
-
Pass Responds to ping from LON1 PING-OK
avg 4.64 ms
HTTPS · redirect trail
301https://bbc.com/→
200https://www.bbc.com/
- Final
- https://www.bbc.com/
- Timings
- DNS 0 · connect 5 · TLS 0 · first byte 40 · total 49 ms
- Body
- 655,685 bytes (gzip)
Plain HTTP · redirect trail
301http://bbc.com/→
301https://bbc.com/→
200https://www.bbc.com/
- Final
- https://www.bbc.com/
- Timings
- DNS 0 · connect 5 · TLS 0 · first byte 55 · total 63 ms
- Body
- 655,685 bytes (gzip)
TLS certificate score 100/100 · A
- 25/25Certificate within validityValid for 86 more days.
- 20/20Chain verifies to a trusted rootFull chain sent and trusted.
- 10/10Certificate matches the host nameHost name is on the certificate.
- 10/10Key strengthRSA 2048-bit.
- 5/5Signature algorithmrsa-sha256
- 15/15Legacy protocols refusedTLS 1.0/1.1 refused.
- 10/10TLS 1.3 offeredModern clients get TLS 1.3.
- 5/5HSTS sentPins the browser to HTTPS after the first visit.
- Subject
- www.bbc.com
- Issuer
- GlobalSign nv-sa GlobalSign GCC R46 OV TLS CA 2025
- Valid
- 21 Aug 2026 – 24 Jan 2027 (86 days left)
- Key
- RSA 2048-bit · RSA-SHA256
- Names
- www.bbc.com, account.bbc.com, session.bbc.com, account.bbc.co.uk, bbc.co.uk, bbcrussian.com, cdnedge.bbc.co.uk, news.bbc.co.uk, news.bbcimg.co.uk, newsimg.bbc.co.uk, newsrss.bbc.co.uk, newsvote.bbc.co.uk … +10
- Chain
- verifies · 3 certificate(s)
- Negotiated
- TLSv1.3 · TLS_AES_128_GCM_SHA256
- Protocols
- TLSv1TLSv1.1TLSv1.2TLSv1.3
Security headers grade C · 50/100
- 25/25Strict-Transport-SecurityPresent with a six-month or longer max-age.
- 0/25Content-Security-PolicyMissing: no defence in depth against injected scripts.
- 10/10X-Content-Type-Optionsnosniff stops MIME-type guessing.
- 15/15X-Frame-Options / frame-ancestorsPages cannot be framed by other sites.
- 0/10Referrer-Policy'no-referrer-when-downgrade' leaks full URLs cross-site.
- 0/10Permissions-PolicySwitches off browser features the site does not use.
- 0/5Cross-Origin-Opener-PolicyIsolates the window from cross-origin openers.
- ✓ HSTS max-age=31536000; preload
- – Content-Security-Policy Limits where scripts and content may load from.
- ✓ X-Frame-Options SAMEORIGIN
- ✓ X-Content-Type-Options nosniff
- ✓ Referrer-Policy no-referrer-when-downgrade
- – Permissions-Policy Limits browser features such as camera or geolocation.
Ping from LON1
4/4 replies · 0% loss · min/avg/max 4.585/4.64/4.684 ms
#1 4.68ms #2 4.59ms #3 4.62ms #4 4.67ms
Ports: 80 open443 open
Traceroute from LON1
| 1 | 185.119.110.1 | 0.935 ms | |
| 2 | 185.27.244.17 | xe-0-1-5.juniper2.cwcs.net | 4.653 ms |
| 3 | 83.217.238.61 | xe-1-4-2-0.a02.londen12.uk.bb.gin.ntt.net | 5.032 ms |
| 4 | 168.143.97.78 | ae-2.fastly.londen12.uk.bb.gin.ntt.net | 8.775 ms |
| 5 | 151.101.0.81 | 4.779 ms |