google.co.uk
domain Headers F TLS 95 HTTPS 200 TLS 52 dHosted by Google Cloud (AS15169) · Address 142.251.29.94, 2a00:1450:4009:c0b:0:0:0:5e · HTTP/2 · 101 ms · Server gws · “Google”
Findings
-
Fail Security headers grade F SEC-HEADERS-GRADE
15 / 100: almost no browser protections are declared.
How to fix: Start with Strict-Transport-Security and X-Content-Type-Options, then add a Content-Security-Policy in report-only mode.
-
Caution Plain HTTP serves content instead of redirecting to HTTPS WEB-HTTP-NO-REDIRECT
How to fix: Redirect http:// to https:// with a 301.
-
Caution No HTTP Strict Transport Security header HSTS-MISSING
Browsers may still try plain HTTP first on each visit.
How to fix: Send "Strict-Transport-Security: max-age=31536000; includeSubDomains".
-
Note No Content-Security-Policy CSP-MISSING
-
Note No X-Content-Type-Options header NOSNIFF-MISSING
-
Pass Site answers over HTTPS WEB-HTTPS-OK
HTTP 200 in 101 ms
-
Pass TLS score 95 (A) TLS-SCORE
On our published rubric: validity, trust, key, protocols, HSTS.
-
Pass Certificate valid for 52 more days TLS-VALIDITY-OK
2026-12-21T18:41:47+00:00
-
Pass Certificate chain verifies TLS-TRUSTED
Google Trust Services WE2
-
Pass TLS 1.3 supported; legacy protocols refused TLS-MODERN
TLSv1.3
-
Pass Responds to ping from LON1 PING-OK
avg 5.262 ms
HTTPS · redirect trail
301https://google.co.uk/→
301https://www.google.co.uk/→
200https://www.google.com/
- Final
- https://www.google.com/
- Timings
- DNS 0 · connect 7 · TLS 0 · first byte 94 · total 101 ms
- Body
- 91,454 bytes (gzip)
Plain HTTP · redirect trail
301http://google.co.uk/→
301http://www.google.co.uk/→
200http://www.google.com/
- Final
- http://www.google.com/
- Timings
- DNS 0 · connect 6 · TLS 0 · first byte 66 · total 74 ms
- Body
- 90,974 bytes (gzip)
TLS certificate score 95/100 · A
- 25/25Certificate within validityValid for 52 more days.
- 20/20Chain verifies to a trusted rootFull chain sent and trusted.
- 10/10Certificate matches the host nameHost name is on the certificate.
- 10/10Key strengthECDSA 256-bit.
- 5/5Signature algorithmecdsa-with-sha256
- 15/15Legacy protocols refusedTLS 1.0/1.1 refused.
- 10/10TLS 1.3 offeredModern clients get TLS 1.3.
- 0/5HSTS sentPins the browser to HTTPS after the first visit.
- Subject
- *.google.co.uk
- Issuer
- Google Trust Services WE2
- Valid
- 28 Sep 2026 – 21 Dec 2026 (52 days left)
- Key
- ECDSA 256-bit · ecdsa-with-SHA256
- Names
- *.google.co.uk, google.co.uk
- Chain
- verifies · 3 certificate(s)
- Negotiated
- TLSv1.3 · TLS_AES_256_GCM_SHA384
- Protocols
- TLSv1TLSv1.1TLSv1.2TLSv1.3
Security headers grade F · 15/100
- 0/25Strict-Transport-SecurityMissing: browsers keep trying plain HTTP.
- 0/25Content-Security-PolicyMissing: no defence in depth against injected scripts.
- 0/10X-Content-Type-Optionsnosniff stops MIME-type guessing.
- 15/15X-Frame-Options / frame-ancestorsPages cannot be framed by other sites.
- 0/10Referrer-PolicyMissing: full URLs may leak to other sites.
- 0/10Permissions-PolicySwitches off browser features the site does not use.
- 0/5Cross-Origin-Opener-PolicyIsolates the window from cross-origin openers.
- – HSTS Tells browsers to use HTTPS only.
- – Content-Security-Policy Limits where scripts and content may load from.
- ✓ X-Frame-Options SAMEORIGIN
- – X-Content-Type-Options Stops MIME-type sniffing.
- – Referrer-Policy Controls what URL is leaked to other sites.
- – Permissions-Policy Limits browser features such as camera or geolocation.
Ping from LON1
4/4 replies · 0% loss · min/avg/max 5.228/5.262/5.295 ms
#1 5.27ms #2 5.3ms #3 5.23ms #4 5.26ms
Ports: 80 open443 open
Traceroute from LON1
| 1 | 185.119.110.1 | 1.062 ms | |
| 2 | 185.27.244.17 | xe-0-1-5.juniper2.cwcs.net | 8.143 ms |
| 3 | 185.27.244.24 | xe-0-1-0.juniper1.thw.cwcs.net | 4.746 ms |
| 4 | 195.66.224.125 | 4.879 ms | |
| 5 | 142.251.29.94 | uv-in-f94.1e100.net | 5.585 ms |