example.com
domain Headers F TLS 95 HTTPS 200 TLS 58 dHosted by Cloudflare (AS13335) · Address 104.20.23.154, 172.66.147.243, 2606:4700:10:0:0:0:ac42:93f3, 2606:4700:10:0:0:0:6814:179a · HTTP/2 · 66 ms · Server cloudflare · “Example Domain”
Findings
-
Fail Security headers grade F SEC-HEADERS-GRADE
0 / 100: almost no browser protections are declared.
How to fix: Start with Strict-Transport-Security and X-Content-Type-Options, then add a Content-Security-Policy in report-only mode.
-
Caution Plain HTTP serves content instead of redirecting to HTTPS WEB-HTTP-NO-REDIRECT
How to fix: Redirect http:// to https:// with a 301.
-
Caution No HTTP Strict Transport Security header HSTS-MISSING
Browsers may still try plain HTTP first on each visit.
How to fix: Send "Strict-Transport-Security: max-age=31536000; includeSubDomains".
-
Note No Content-Security-Policy CSP-MISSING
-
Note No X-Content-Type-Options header NOSNIFF-MISSING
-
Note No clickjacking protection (X-Frame-Options or frame-ancestors) XFO-MISSING
-
Pass Site answers over HTTPS WEB-HTTPS-OK
HTTP 200 in 66 ms
-
Pass TLS score 95 (A) TLS-SCORE
On our published rubric: validity, trust, key, protocols, HSTS.
-
Pass Certificate valid for 58 more days TLS-VALIDITY-OK
2026-12-25T22:56:35+00:00
-
Pass Certificate chain verifies TLS-TRUSTED
SSL Corporation Cloudflare TLS Issuing ECC CA 3
-
Pass TLS 1.3 supported; legacy protocols refused TLS-MODERN
TLSv1.3
-
Pass Responds to ping from LON1 PING-OK
avg 5.397 ms
HTTPS · redirect trail
200https://example.com/
- Final
- https://example.com/
- Timings
- DNS 0 · connect 7 · TLS 0 · first byte 66 · total 66 ms
- Body
- 577 bytes (br)
Plain HTTP · redirect trail
200http://example.com/
- Final
- http://example.com/
- Timings
- DNS 0 · connect 6 · TLS 0 · first byte 25 · total 26 ms
- Body
- 577 bytes (br)
TLS certificate score 95/100 · A
- 25/25Certificate within validityValid for 58 more days.
- 20/20Chain verifies to a trusted rootFull chain sent and trusted.
- 10/10Certificate matches the host nameHost name is on the certificate.
- 10/10Key strengthECDSA 256-bit.
- 5/5Signature algorithmecdsa-with-sha256
- 15/15Legacy protocols refusedTLS 1.0/1.1 refused.
- 10/10TLS 1.3 offeredModern clients get TLS 1.3.
- 0/5HSTS sentPins the browser to HTTPS after the first visit.
- Subject
- example.com
- Issuer
- SSL Corporation Cloudflare TLS Issuing ECC CA 3
- Valid
- 26 Sep 2026 – 25 Dec 2026 (58 days left)
- Key
- ECDSA 256-bit · ecdsa-with-SHA256
- Names
- example.com, *.example.com
- Chain
- verifies · 4 certificate(s)
- Negotiated
- TLSv1.3 · TLS_AES_256_GCM_SHA384
- Protocols
- TLSv1TLSv1.1TLSv1.2TLSv1.3
Security headers grade F · 0/100
- 0/25Strict-Transport-SecurityMissing: browsers keep trying plain HTTP.
- 0/25Content-Security-PolicyMissing: no defence in depth against injected scripts.
- 0/10X-Content-Type-Optionsnosniff stops MIME-type guessing.
- 0/15X-Frame-Options / frame-ancestorsMissing: pages can be framed for click-jacking.
- 0/10Referrer-PolicyMissing: full URLs may leak to other sites.
- 0/10Permissions-PolicySwitches off browser features the site does not use.
- 0/5Cross-Origin-Opener-PolicyIsolates the window from cross-origin openers.
- – HSTS Tells browsers to use HTTPS only.
- – Content-Security-Policy Limits where scripts and content may load from.
- – X-Frame-Options Blocks clickjacking by refusing to be framed.
- – X-Content-Type-Options Stops MIME-type sniffing.
- – Referrer-Policy Controls what URL is leaked to other sites.
- – Permissions-Policy Limits browser features such as camera or geolocation.
Ping from LON1
4/4 replies · 0% loss · min/avg/max 5.3/5.397/5.487 ms
#1 5.43ms #2 5.3ms #3 5.37ms #4 5.49ms
Ports: 80 open443 open
Traceroute from LON1
| 1 | 185.119.110.1 | 1.072 ms | |
| 2 | 185.27.244.17 | xe-0-1-5.juniper2.cwcs.net | 4.908 ms |
| 3 | 185.27.244.24 | xe-0-1-0.juniper1.thw.cwcs.net | 4.746 ms |
| 4 | 195.66.225.179 | linx-lon1.as13335.net | 7.014 ms |
| 5 | * | 0 ms | |
| 6 | 141.101.71.125 | 5.812 ms | |
| 7 | 104.20.23.154 | 5.486 ms |