Illustrative example
Site audit example report
Warninghttp://www.demo.example/old-guide?lang=[redacted]
This is a permanent example with fictional data for demo.example. No scan runs when you open this page. Dates, timings and results are illustrative.
A page has a long redirect chain, a missing description and incomplete sitemap evidence. The six modules show why measured findings and unavailable checks need different follow-up.
What to do next: Review the redirect path and page metadata, check renewal, then inspect the sitemap separately. Confirm which domain actually handles mail before acting on DNS warnings.
Score: 86 / 100
Technical checks for one page and host.
90% measured · Scoring
Unknown and inapplicable checks are excluded and their weight is redistributed. No total score is shown below 70% coverage.
Recommended actions
- TLS: Renew the certificate and check its validity period.
- SEO basics: Add a descriptive meta description.
- HTTP and headers: Restrict scripts with script-src or default-src. Avoid wildcard, unsafe-inline and unsafe-eval. Use nonces or hashes where needed.
Redirect path
-
Step 1 · HTTP 301
http://www.demo.example/old-guide?lang=[redacted]
-
Step 2 · HTTP 301
https://www.demo.example/old-guide?lang=[redacted]
-
Step 3 · HTTP 301
https://demo.example/old-guide?lang=[redacted]
-
Step 4 · HTTP 200
https://demo.example/guides/tls?lang=[redacted]
Final URL: https://demo.example/guides/tls?lang=[redacted]
HTTP and headers
WarningScore: 86 / 100
- HTTPS · The final response uses HTTPS.
- HSTS · HSTS found. Checked max-age and duplicate headers.
- Content-Security-Policy · No enforced CSP received.
Details for HTTP and headers
Weight 25% · Effective 27.78% · headers-v1 · 13:00:00 CET
HTTP 200 · 38.2 ms. Compression: not found; not actively negotiated.
- Passed
HTTPS
The final response uses HTTPS.
HTTPS encrypts data in transit. This check is not a full TLS audit.
Redirect visitors to HTTPS and use a valid certificate.
Confirm that the final resource uses HTTPS, then test the HTTP entry URL and its destination.
- Warning
HSTS
HSTS found. Checked max-age and duplicate headers.
Browsers only accept HSTS over HTTPS. A max-age of zero disables it; short durations offer less protection.
Use one HSTS header over HTTPS with max-age of at least 15552000. Include subdomains only if they all support HTTPS.
Review the HTTPS endpoint and every subdomain before extending HSTS coverage. A browser remembers the policy for its declared lifetime.
- Warning
Content-Security-Policy
No enforced CSP received.
Checks script/default sources for permissive tokens. Source trust and full browser syntax are not assessed. Report-Only policies do not enforce restrictions.
Restrict scripts with script-src or default-src. Avoid wildcard, unsafe-inline and unsafe-eval. Use nonces or hashes where needed.
Review script dependencies and browser violations before enforcing a stricter policy. This finding checks received script-source tokens, not application exploitability.
- Not checked
X-Content-Type-Options
Checked the nosniff configuration.
nosniff prevents browsers from guessing content types. Duplicate headers make the configuration ambiguous.
Send one X-Content-Type-Options: nosniff header and the correct Content-Type.
This measurement is incomplete. Use the explanation to check the outcome independently.
Check the response Content-Type alongside nosniff, including public assets and error responses.
- Passed
Referrer-Policy
Checked the last recognized referrer policy.
A permissive policy may share path and query data with other sites. Browser defaults may already offer protection.
Choose no-referrer or strict-origin-when-cross-origin to suit the site.
Choose how much URL information the browser should share, then verify the deployed policy.
- Info
Permissions-Policy
Permissions-Policy found; values are redacted.
Required browser features vary by site. Presence does not prove a safe configuration; this check is not scored.
Disable unused features such as camera, microphone and location where appropriate.
Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.
- Passed
Framing protection
Checked X-Frame-Options.
A restrictive frame-ancestors policy can replace X-Frame-Options. A wildcard does not provide general framing protection.
Use CSP frame-ancestors with trusted sources, or X-Frame-Options: DENY / SAMEORIGIN.
List the parents allowed to embed this page before choosing frame-ancestors or X-Frame-Options.
- Info
Cross-Origin-Opener-Policy
Header missing.
Suitable isolation depends on pop-ups and external resources. This check is not scored.
Check which cross-origin interactions the site needs.
Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.
- Info
Cross-Origin-Resource-Policy
Header missing.
Suitable isolation depends on pop-ups and external resources. This check is not scored.
Check which cross-origin interactions the site needs.
Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.
- Info
CORS configuration
No Access-Control-* headers received.
No controlled Origin or preflight was sent. CORS security was not assessed.
Test allowed and denied Origins and preflight separately.
Test allowed and denied Origin requests and preflights separately. This scan did not perform a full CORS test.
- Passed
Cookie 1 · Secure
Secure found.
Secure restricts transmission to HTTPS.
Use HTTPS and set Secure on this cookie.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Passed
Cookie 1 · HttpOnly
HttpOnly found.
Session cookies should usually be HttpOnly. Cookies intentionally read by JavaScript may be an exception.
Set HttpOnly when JavaScript does not need the cookie.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Passed
Cookie 1 · SameSite
SameSite=Lax.
SameSite restricts cross-site transmission. None requires Secure and may be needed for external integrations.
Choose Lax or Strict explicitly. Use None with Secure only when cross-site transmission is needed.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Passed
Cookie 1 · Domain
Host-only cookie without Domain.
Without Domain, the cookie stays on the current host. Browsers reject mismatched Domain values.
Omit Domain unless sharing with subdomains is necessary.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Info
Cookie 1 · Path
Path is set; the value is redacted.
Path controls where the cookie is sent, but is not a security boundary.
Use a valid path that matches the purpose of the cookie.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Info
Cookie 1 · Expires / Max-Age
Session cookie without an explicit lifetime.
Session cookies are allowed. The appropriate lifetime depends on their purpose; values are not stored.
Choose the shortest suitable lifetime and use a valid Max-Age or Expires.
Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.
- Passed
Cache-Control
Explicit cache directives found.
Missing cache headers are not always an error. Personal data may need no-store or private. Set-Cookie alone does not prevent shared caching.
Choose an explicit policy for the content. no-cache allows storage with revalidation.
Match the policy to public, personalized or sensitive content and inspect any CDN overrides. A public scan cannot verify a signed-in response.
- Passed
ETag / Last-Modified
Revalidation header found. Identifying values are redacted.
Validators save bandwidth on revalidation. They are not needed with no-store and may be intentionally omitted.
Use a validator for content that browsers may store and revalidate.
ETag and Last-Modified support conditional requests. Check that a changed resource gets a new validator and that an unchanged resource can be revalidated correctly.
- Info
Vary
Vary found.
Vary distinguishes response variants. A specific CORS Origin may require Vary: Origin. This is not a full CORS test.
Use Vary: Origin when Access-Control-Allow-Origin varies by request.
Compare requests with different values for fields that select a response variant, such as Origin or Accept-Encoding. Check that the CDN includes the intended variation in its cache behavior.
- Info
CDN hints
No known CDN hints received.
CDN hints do not prove that personal content is cached safely. Unknown values are redacted.
Check CDN cache settings for personal responses.
Compare repeat requests and the cache evidence returned by the edge. Review CDN rules alongside Cache-Control; an edge header alone does not reveal all stored variants.
- Passed
Product and version headers
Product information found, with no recognizable version.
Product or version details do not prove a vulnerability, but can identify the software in use.
Remove unnecessary version headers and keep software up to date.
Compare a successful page with the response shown here and review unnecessary implementation details. This is not a vulnerability diagnosis.
- Info
Server information
Server information is redacted in All headers.
Only known product names and versions remain visible. Other values may contain sensitive data.
Limit server information to what is operationally necessary.
Compare a successful page with the response shown here and review unnecessary implementation details. This is not a vulnerability diagnosis.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[
{
"code": "security.transport",
"title": "HTTPS",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "security.hsts",
"title": "HSTS",
"status": "warning",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 5.49
},
{
"code": "security.csp",
"title": "Content-Security-Policy",
"status": "warning",
"counted": true,
"weight": 15,
"possible": 16.48,
"earned": 8.24
},
{
"code": "security.nosniff",
"title": "X-Content-Type-Options",
"status": "unknown",
"counted": false,
"weight": 5,
"possible": 0,
"earned": 0
},
{
"code": "security.referrer",
"title": "Referrer-Policy",
"status": "pass",
"counted": true,
"weight": 5,
"possible": 5.49,
"earned": 5.49
},
{
"code": "security.permissions",
"title": "Permissions-Policy",
"status": "info",
"counted": false,
"weight": 2,
"possible": 0,
"earned": 0
},
{
"code": "security.frames",
"title": "Framing protection",
"status": "pass",
"counted": true,
"weight": 8,
"possible": 8.79,
"earned": 8.79
},
{
"code": "security.cross-origin-opener-policy",
"title": "Cross-Origin-Opener-Policy",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "security.cross-origin-resource-policy",
"title": "Cross-Origin-Resource-Policy",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "security.cors",
"title": "CORS configuration",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cookie.1.secure",
"title": "Cookie 1 · Secure",
"status": "pass",
"counted": true,
"weight": 8,
"possible": 8.79,
"earned": 8.79
},
{
"code": "cookie.1.httponly",
"title": "Cookie 1 · HttpOnly",
"status": "pass",
"counted": true,
"weight": 4,
"possible": 4.4,
"earned": 4.4
},
{
"code": "cookie.1.samesite",
"title": "Cookie 1 · SameSite",
"status": "pass",
"counted": true,
"weight": 6,
"possible": 6.59,
"earned": 6.59
},
{
"code": "cookie.1.domain",
"title": "Cookie 1 · Domain",
"status": "pass",
"counted": true,
"weight": 2,
"possible": 2.2,
"earned": 2.2
},
{
"code": "cookie.1.path",
"title": "Cookie 1 · Path",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cookie.1.lifetime",
"title": "Cookie 1 · Expires / Max-Age",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cache.policy",
"title": "Cache-Control",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "cache.validators",
"title": "ETag / Last-Modified",
"status": "pass",
"counted": true,
"weight": 3,
"possible": 3.3,
"earned": 3.3
},
{
"code": "cache.vary",
"title": "Vary",
"status": "info",
"counted": false,
"weight": 2,
"possible": 0,
"earned": 0
},
{
"code": "cache.cdn",
"title": "CDN hints",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "server.versions",
"title": "Product and version headers",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "server.products",
"title": "Server information",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
}
]
Evidence and scope
{
"ruleset_version": "headers-v1",
"summary": "Headers from the final HTTP response.",
"analysis_status": "warning",
"completed": true,
"redirect_count": 3,
"final_url": "https://demo.example/guides/tls?lang=[redacted]",
"final_http_status": 200,
"headers": {
"content-type": [
"text/html; charset=utf-8"
],
"strict-transport-security": [
"max-age=86400"
],
"content-security-policy-report-only": [
"[redacted]"
],
"x-content-type-options": [
"nosniff",
"nosniff"
],
"x-frame-options": [
"DENY"
],
"referrer-policy": [
"strict-origin-when-cross-origin"
],
"permissions-policy": [
"[redacted]"
],
"set-cookie": [
"[redacted]"
],
"cache-control": [
"private, no-cache"
],
"etag": [
"[redacted]"
],
"vary": [
"Accept-Encoding"
],
"server": [
"nginx"
]
},
"findings": [
{
"code": "security.transport",
"category": "security",
"title": "HTTPS",
"status": "pass",
"observation": "The final response uses HTTPS.",
"reason": "HTTPS encrypts data in transit. This check is not a full TLS audit.",
"improvement": "Redirect visitors to HTTPS and use a valid certificate.",
"weight": 10,
"applicable": true
},
{
"code": "security.hsts",
"category": "security",
"title": "HSTS",
"status": "warning",
"observation": "HSTS found. Checked max-age and duplicate headers.",
"reason": "Browsers only accept HSTS over HTTPS. A max-age of zero disables it; short durations offer less protection.",
"improvement": "Use one HSTS header over HTTPS with max-age of at least 15552000. Include subdomains only if they all support HTTPS.",
"weight": 10,
"applicable": true
},
{
"code": "security.csp",
"category": "security",
"title": "Content-Security-Policy",
"status": "warning",
"observation": "No enforced CSP received.",
"reason": "Checks script/default sources for permissive tokens. Source trust and full browser syntax are not assessed. Report-Only policies do not enforce restrictions.",
"improvement": "Restrict scripts with script-src or default-src. Avoid wildcard, unsafe-inline and unsafe-eval. Use nonces or hashes where needed.",
"weight": 15,
"applicable": true
},
{
"code": "security.nosniff",
"category": "security",
"title": "X-Content-Type-Options",
"status": "unknown",
"observation": "Checked the nosniff configuration.",
"reason": "nosniff prevents browsers from guessing content types. Duplicate headers make the configuration ambiguous.",
"improvement": "Send one X-Content-Type-Options: nosniff header and the correct Content-Type.",
"weight": 5,
"applicable": true
},
{
"code": "security.referrer",
"category": "security",
"title": "Referrer-Policy",
"status": "pass",
"observation": "Checked the last recognized referrer policy.",
"reason": "A permissive policy may share path and query data with other sites. Browser defaults may already offer protection.",
"improvement": "Choose no-referrer or strict-origin-when-cross-origin to suit the site.",
"weight": 5,
"applicable": true
},
{
"code": "security.permissions",
"category": "security",
"title": "Permissions-Policy",
"status": "info",
"observation": "Permissions-Policy found; values are redacted.",
"reason": "Required browser features vary by site. Presence does not prove a safe configuration; this check is not scored.",
"improvement": "Disable unused features such as camera, microphone and location where appropriate.",
"weight": 2,
"applicable": true
},
{
"code": "security.frames",
"category": "security",
"title": "Framing protection",
"status": "pass",
"observation": "Checked X-Frame-Options.",
"reason": "A restrictive frame-ancestors policy can replace X-Frame-Options. A wildcard does not provide general framing protection.",
"improvement": "Use CSP frame-ancestors with trusted sources, or X-Frame-Options: DENY / SAMEORIGIN.",
"weight": 8,
"applicable": true
},
{
"code": "security.cross-origin-opener-policy",
"category": "security",
"title": "Cross-Origin-Opener-Policy",
"status": "info",
"observation": "Header missing.",
"reason": "Suitable isolation depends on pop-ups and external resources. This check is not scored.",
"improvement": "Check which cross-origin interactions the site needs.",
"weight": 0,
"applicable": true
},
{
"code": "security.cross-origin-resource-policy",
"category": "security",
"title": "Cross-Origin-Resource-Policy",
"status": "info",
"observation": "Header missing.",
"reason": "Suitable isolation depends on pop-ups and external resources. This check is not scored.",
"improvement": "Check which cross-origin interactions the site needs.",
"weight": 0,
"applicable": true
},
{
"code": "security.cors",
"category": "security",
"title": "CORS configuration",
"status": "info",
"observation": "No Access-Control-* headers received.",
"reason": "No controlled Origin or preflight was sent. CORS security was not assessed.",
"improvement": "Test allowed and denied Origins and preflight separately.",
"weight": 0,
"applicable": true
},
{
"code": "cookie.1.secure",
"category": "cookies",
"title": "Cookie 1 · Secure",
"status": "pass",
"observation": "Secure found.",
"reason": "Secure restricts transmission to HTTPS.",
"improvement": "Use HTTPS and set Secure on this cookie.",
"weight": 8,
"applicable": true
},
{
"code": "cookie.1.httponly",
"category": "cookies",
"title": "Cookie 1 · HttpOnly",
"status": "pass",
"observation": "HttpOnly found.",
"reason": "Session cookies should usually be HttpOnly. Cookies intentionally read by JavaScript may be an exception.",
"improvement": "Set HttpOnly when JavaScript does not need the cookie.",
"weight": 4,
"applicable": true
},
{
"code": "cookie.1.samesite",
"category": "cookies",
"title": "Cookie 1 · SameSite",
"status": "pass",
"observation": "SameSite=Lax.",
"reason": "SameSite restricts cross-site transmission. None requires Secure and may be needed for external integrations.",
"improvement": "Choose Lax or Strict explicitly. Use None with Secure only when cross-site transmission is needed.",
"weight": 6,
"applicable": true
},
{
"code": "cookie.1.domain",
"category": "cookies",
"title": "Cookie 1 · Domain",
"status": "pass",
"observation": "Host-only cookie without Domain.",
"reason": "Without Domain, the cookie stays on the current host. Browsers reject mismatched Domain values.",
"improvement": "Omit Domain unless sharing with subdomains is necessary.",
"weight": 2,
"applicable": true
},
{
"code": "cookie.1.path",
"category": "cookies",
"title": "Cookie 1 · Path",
"status": "info",
"observation": "Path is set; the value is redacted.",
"reason": "Path controls where the cookie is sent, but is not a security boundary.",
"improvement": "Use a valid path that matches the purpose of the cookie.",
"weight": 0,
"applicable": true
},
{
"code": "cookie.1.lifetime",
"category": "cookies",
"title": "Cookie 1 · Expires / Max-Age",
"status": "info",
"observation": "Session cookie without an explicit lifetime.",
"reason": "Session cookies are allowed. The appropriate lifetime depends on their purpose; values are not stored.",
"improvement": "Choose the shortest suitable lifetime and use a valid Max-Age or Expires.",
"weight": 0,
"applicable": true
},
{
"code": "cache.policy",
"category": "caching",
"title": "Cache-Control",
"status": "pass",
"observation": "Explicit cache directives found.",
"reason": "Missing cache headers are not always an error. Personal data may need no-store or private. Set-Cookie alone does not prevent shared caching.",
"improvement": "Choose an explicit policy for the content. no-cache allows storage with revalidation.",
"weight": 10,
"applicable": true
},
{
"code": "cache.validators",
"category": "caching",
"title": "ETag / Last-Modified",
"status": "pass",
"observation": "Revalidation header found. Identifying values are redacted.",
"reason": "Validators save bandwidth on revalidation. They are not needed with no-store and may be intentionally omitted.",
"improvement": "Use a validator for content that browsers may store and revalidate.",
"weight": 3,
"applicable": true
},
{
"code": "cache.vary",
"category": "caching",
"title": "Vary",
"status": "info",
"observation": "Vary found.",
"reason": "Vary distinguishes response variants. A specific CORS Origin may require Vary: Origin. This is not a full CORS test.",
"improvement": "Use Vary: Origin when Access-Control-Allow-Origin varies by request.",
"weight": 2,
"applicable": false
},
{
"code": "cache.cdn",
"category": "caching",
"title": "CDN hints",
"status": "info",
"observation": "No known CDN hints received.",
"reason": "CDN hints do not prove that personal content is cached safely. Unknown values are redacted.",
"improvement": "Check CDN cache settings for personal responses.",
"weight": 0,
"applicable": true
},
{
"code": "server.versions",
"category": "server",
"title": "Product and version headers",
"status": "pass",
"observation": "Product information found, with no recognizable version.",
"reason": "Product or version details do not prove a vulnerability, but can identify the software in use.",
"improvement": "Remove unnecessary version headers and keep software up to date.",
"weight": 10,
"applicable": true
},
{
"code": "server.products",
"category": "server",
"title": "Server information",
"status": "info",
"observation": "Server information is redacted in All headers.",
"reason": "Only known product names and versions remain visible. Other values may contain sensitive data.",
"improvement": "Limit server information to what is operationally necessary.",
"weight": 0,
"applicable": true
}
],
"score": 86,
"score_rules": [
{
"code": "security.transport",
"title": "HTTPS",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "security.hsts",
"title": "HSTS",
"status": "warning",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 5.49
},
{
"code": "security.csp",
"title": "Content-Security-Policy",
"status": "warning",
"counted": true,
"weight": 15,
"possible": 16.48,
"earned": 8.24
},
{
"code": "security.nosniff",
"title": "X-Content-Type-Options",
"status": "unknown",
"counted": false,
"weight": 5,
"possible": 0,
"earned": 0
},
{
"code": "security.referrer",
"title": "Referrer-Policy",
"status": "pass",
"counted": true,
"weight": 5,
"possible": 5.49,
"earned": 5.49
},
{
"code": "security.permissions",
"title": "Permissions-Policy",
"status": "info",
"counted": false,
"weight": 2,
"possible": 0,
"earned": 0
},
{
"code": "security.frames",
"title": "Framing protection",
"status": "pass",
"counted": true,
"weight": 8,
"possible": 8.79,
"earned": 8.79
},
{
"code": "security.cross-origin-opener-policy",
"title": "Cross-Origin-Opener-Policy",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "security.cross-origin-resource-policy",
"title": "Cross-Origin-Resource-Policy",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "security.cors",
"title": "CORS configuration",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cookie.1.secure",
"title": "Cookie 1 · Secure",
"status": "pass",
"counted": true,
"weight": 8,
"possible": 8.79,
"earned": 8.79
},
{
"code": "cookie.1.httponly",
"title": "Cookie 1 · HttpOnly",
"status": "pass",
"counted": true,
"weight": 4,
"possible": 4.4,
"earned": 4.4
},
{
"code": "cookie.1.samesite",
"title": "Cookie 1 · SameSite",
"status": "pass",
"counted": true,
"weight": 6,
"possible": 6.59,
"earned": 6.59
},
{
"code": "cookie.1.domain",
"title": "Cookie 1 · Domain",
"status": "pass",
"counted": true,
"weight": 2,
"possible": 2.2,
"earned": 2.2
},
{
"code": "cookie.1.path",
"title": "Cookie 1 · Path",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cookie.1.lifetime",
"title": "Cookie 1 · Expires / Max-Age",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "cache.policy",
"title": "Cache-Control",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "cache.validators",
"title": "ETag / Last-Modified",
"status": "pass",
"counted": true,
"weight": 3,
"possible": 3.3,
"earned": 3.3
},
{
"code": "cache.vary",
"title": "Vary",
"status": "info",
"counted": false,
"weight": 2,
"possible": 0,
"earned": 0
},
{
"code": "cache.cdn",
"title": "CDN hints",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
},
{
"code": "server.versions",
"title": "Product and version headers",
"status": "pass",
"counted": true,
"weight": 10,
"possible": 10.99,
"earned": 10.99
},
{
"code": "server.products",
"title": "Server information",
"status": "info",
"counted": false,
"weight": 0,
"possible": 0,
"earned": 0
}
],
"error_code": null,
"duration_ms": 38.2
}
Redirects
WarningScore: 90 / 100
- long_chain · More than two redirects. Shorten the chain where possible.
- temporary_redirect · No temporary 302 or 307 redirects found.
- query_preservation · All original query parameters and values were preserved.
Details for Redirects
Weight 15% · Effective 16.67% · redirects-v1 · 13:00:00 CET
- Warning
long_chain
More than two redirects. Shorten the chain where possible.
Point old content URLs to their final equivalents and update internal links. Keep necessary authentication and HTTPS steps when shortening the chain.
- Passed
temporary_redirect
No temporary 302 or 307 redirects found.
Decide whether the destination is temporary or permanent. Validate non-GET operations separately; this trace follows GET.
- Passed
query_preservation
All original query parameters and values were preserved.
Check whether the destination still has the path and parameters needed to show the same resource. Verify exact query values locally with harmless examples.
- Info
host_change
Host change: www.demo.example → demo.example.
Confirm that each host change is intended, including www, apex and external destinations. Verify the destination’s HTTPS certificate before relying on the redirect.
- Passed
https_endpoint
The chain ends on HTTPS.
Verify HTTPS and a valid certificate on every supported hostname, including aliases that redirect. TLS must succeed before an HTTPS redirect can be read.
- Info
http_upgrade
An HTTP URL redirects to HTTPS.
Start with the HTTP URL and confirm it reaches the intended HTTPS page. Check deep links, aliases, meaningful parameters and browser behavior.
- Passed
termination
The HTTP endpoint was reached.
Read each Location in order and identify which layer owns it. A limit or connection failure does not by itself prove a loop.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[]
Evidence and scope
{
"ruleset_version": "redirects-v1",
"summary": "Endpoint reached. Redirects followed: 3.",
"analysis_status": "warning",
"score": 90,
"completed": true,
"redirect_count": 3,
"total_duration_ms": 95.4,
"final_http_status": 200,
"final_url": "https://demo.example/guides/tls?lang=[redacted]",
"hops": [
{
"number": 1,
"url": "http://www.demo.example/old-guide?lang=[redacted]",
"host": "www.demo.example",
"protocol": "http",
"http_status": 301,
"location": "https://www.demo.example/old-guide?lang=[redacted]",
"next_url": "https://www.demo.example/old-guide?lang=[redacted]",
"duration_ms": 18.4,
"error_code": null
},
{
"number": 2,
"url": "https://www.demo.example/old-guide?lang=[redacted]",
"host": "www.demo.example",
"protocol": "https",
"http_status": 301,
"location": "https://demo.example/old-guide?lang=[redacted]",
"next_url": "https://demo.example/old-guide?lang=[redacted]",
"duration_ms": 22.7,
"error_code": null
},
{
"number": 3,
"url": "https://demo.example/old-guide?lang=[redacted]",
"host": "demo.example",
"protocol": "https",
"http_status": 301,
"location": "https://demo.example/guides/tls?lang=[redacted]",
"next_url": "https://demo.example/guides/tls?lang=[redacted]",
"duration_ms": 16.1,
"error_code": null
},
{
"number": 4,
"url": "https://demo.example/guides/tls?lang=[redacted]",
"host": "demo.example",
"protocol": "https",
"http_status": 200,
"location": null,
"next_url": null,
"duration_ms": 38.2,
"error_code": null
}
],
"findings": [
{
"code": "long_chain",
"status": "warning",
"message": "More than two redirects. Shorten the chain where possible.",
"deduction": 10
},
{
"code": "temporary_redirect",
"status": "pass",
"message": "No temporary 302 or 307 redirects found.",
"deduction": 0
},
{
"code": "query_preservation",
"status": "pass",
"message": "All original query parameters and values were preserved.",
"deduction": 0
},
{
"code": "host_change",
"status": "info",
"message": "Host change: www.demo.example → demo.example.",
"deduction": 0
},
{
"code": "https_endpoint",
"status": "pass",
"message": "The chain ends on HTTPS.",
"deduction": 0
},
{
"code": "http_upgrade",
"status": "info",
"message": "An HTTP URL redirects to HTTPS.",
"deduction": 0
},
{
"code": "termination",
"status": "pass",
"message": "The HTTP endpoint was reached.",
"deduction": 0
}
]
}
TLS
WarningScore: 90 / 100
- Trusted connection · Peer and hostname verification passed.
- Hostname · The certificate was verified against the original hostname.
- Validity period · The certificate expires within 30 days.
Details for TLS
Weight 20% · Effective 22.22% · tls-v2 · 13:00:00 CET
- Passed
Trusted connection
Peer and hostname verification passed.
Verify the public endpoint with certificate checks enabled and review the received bundle and client trust store. Diagnostic details do not establish trust.
- Passed
Hostname
The certificate was verified against the original hostname.
Compare the exact requested hostname with the certificate SAN entries before relying on an HTTPS redirect.
- Warning
Validity period
The certificate expires within 30 days.
Compare the certificate served publicly with the renewed certificate file. Renewal and deployment are separate checks.
- Passed
Chain trust
The chain is trusted. The certificate chain section shows only received certificates.
Verify the public endpoint with certificate checks enabled and review the received bundle and client trust store. Diagnostic details do not establish trust.
- Info
Negotiated protocol
Read from the connection metadata of the verified handshake.
Review the negotiated version and the separate protocol probes. An unknown probe does not establish support or rejection.
- Passed
Public key strength
The public key meets the baseline size: RSA 2048 bits or EC 256 bits.
Review the key and signature metadata against current provider and client requirements. This check is separate from the basic connection score.
- Passed
Signature algorithm
The certificate uses a SHA-256, SHA-384 or SHA-512 signature algorithm.
Review the key and signature metadata against current provider and client requirements. This check is separate from the basic connection score.
- Not checked
OCSP / CRL revocation
Revocation could not be verified. A trusted TLS handshake alone does not prove that the certificate has not been revoked. OCSP was not checked.
This measurement is incomplete. Use the explanation to check the outcome independently.
Read the method and scope of this measurement. An unavailable result or detected extension does not establish certificate compliance.
- Not checked
Certificate Transparency
2 embedded Signed Certificate Timestamps (SCTs) found. Log signatures, operators and browser CT policy were not verified.
This measurement is incomplete. Use the explanation to check the outcome independently.
SCT-related certificate data indicates transparency information was supplied. The scanner does not verify log inclusion or determine compliance with a browser’s CT policy.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[
{
"label": "Connection and trust",
"status": "pass",
"maximum": 50,
"points": 50
},
{
"label": "Hostname",
"status": "pass",
"maximum": 25,
"points": 25
},
{
"label": "Validity period",
"status": "warning",
"maximum": 25,
"points": 15
}
]
Evidence and scope
{
"ruleset_version": "tls-v2",
"summary": "TLS connection and hostname verified.",
"analysis_status": "warning",
"completed": true,
"trusted": true,
"diagnostic": false,
"verification_status": "pass",
"hostname_status": "pass",
"validity_status": "warning",
"certificate": {
"subject": "CN=demo.example",
"issuer": "CN=Example Intermediate CA, O=Illustrative Certificate Authority",
"valid_from": 1787140800,
"valid_until": 1794916800,
"san": [
"DNS:demo.example",
"DNS:www.demo.example"
],
"san_total": 2,
"serial": "01A2B3C4",
"fingerprint_sha256": "779b344296da1f642519ffa0f991b148c33340fb053fcaee2552103f1cf39525",
"key_bits": 2048,
"is_ca": false,
"self_signed": false,
"ct_present": true,
"sct_count": 2,
"pem": null,
"common_name": "demo.example",
"organization": "",
"issuer_common_name": "Example Intermediate CA",
"issuer_organization": "Illustrative Certificate Authority",
"issuer_country": "",
"signature_algorithm": "sha256WithRSAEncryption",
"key_type": "RSA",
"key_curve": "",
"validation_type": "Domain Validation",
"issuer_urls": [
"https://demo.example/example-intermediate.crt"
],
"ocsp_urls": [],
"crl_urls": [
"http://demo.example/example-leaf.crl"
]
},
"chain": [
{
"subject": "CN=demo.example",
"issuer": "CN=Example Intermediate CA, O=Illustrative Certificate Authority",
"valid_from": 1787140800,
"valid_until": 1794916800,
"san": [
"DNS:demo.example",
"DNS:www.demo.example"
],
"san_total": 2,
"serial": "01A2B3C4",
"fingerprint_sha256": "779b344296da1f642519ffa0f991b148c33340fb053fcaee2552103f1cf39525",
"key_bits": 2048,
"is_ca": false,
"self_signed": false,
"ct_present": true,
"sct_count": 2,
"pem": null,
"common_name": "demo.example",
"organization": "",
"issuer_common_name": "Example Intermediate CA",
"issuer_organization": "Illustrative Certificate Authority",
"issuer_country": "",
"signature_algorithm": "sha256WithRSAEncryption",
"key_type": "RSA",
"key_curve": "",
"validation_type": "Domain Validation",
"issuer_urls": [
"https://demo.example/example-intermediate.crt"
],
"ocsp_urls": [],
"crl_urls": [
"http://demo.example/example-leaf.crl"
]
},
{
"subject": "CN=Example Intermediate CA, O=Illustrative Certificate Authority",
"issuer": "CN=Example Root CA, O=Illustrative Certificate Authority",
"valid_from": 1761566400,
"valid_until": 1824638400,
"san": [],
"san_total": 0,
"serial": "",
"fingerprint_sha256": "",
"key_bits": null,
"is_ca": true,
"self_signed": false,
"ct_present": null,
"sct_count": null,
"pem": null,
"common_name": "Example Intermediate CA",
"organization": "Illustrative Certificate Authority",
"issuer_common_name": "Example Root CA",
"issuer_organization": "",
"issuer_country": "",
"signature_algorithm": "",
"key_type": "",
"key_curve": "",
"validation_type": "",
"issuer_urls": [],
"ocsp_urls": [],
"crl_urls": []
}
],
"protocol": "TLSv1.3",
"connected_ip": "192.0.2.10",
"cipher": "TLS_AES_128_GCM_SHA256",
"cipher_bits": 128,
"checks": {
"protocols": {
"TLSv1.3": {
"status": "unknown",
"error_code": null
},
"TLSv1.2": {
"status": "unknown",
"error_code": null
},
"TLSv1.1": {
"status": "unknown",
"error_code": null
},
"TLSv1.0": {
"status": "unknown",
"error_code": null
}
},
"caa": {
"status": "unknown",
"source": null,
"records": [],
"error_code": null
},
"revocation": {
"status": "unknown",
"method": null,
"reason": "not_checked"
}
},
"key_status": "pass",
"signature_status": "pass",
"chain_order_status": "unknown",
"validity_days": 90,
"days_remaining": 21,
"findings": [
{
"code": "trust",
"title": "Trusted connection",
"status": "pass",
"message": "Peer and hostname verification passed."
},
{
"code": "hostname",
"title": "Hostname",
"status": "pass",
"message": "The certificate was verified against the original hostname."
},
{
"code": "validity",
"title": "Validity period",
"status": "warning",
"message": "The certificate expires within 30 days."
},
{
"code": "chain",
"title": "Chain trust",
"status": "pass",
"message": "The chain is trusted. The certificate chain section shows only received certificates."
},
{
"code": "protocol",
"title": "Negotiated protocol",
"status": "info",
"message": "Read from the connection metadata of the verified handshake."
},
{
"code": "key",
"title": "Public key strength",
"status": "pass",
"message": "The public key meets the baseline size: RSA 2048 bits or EC 256 bits."
},
{
"code": "signature",
"title": "Signature algorithm",
"status": "pass",
"message": "The certificate uses a SHA-256, SHA-384 or SHA-512 signature algorithm."
},
{
"code": "revocation",
"title": "OCSP / CRL revocation",
"status": "unknown",
"message": "Revocation could not be verified. A trusted TLS handshake alone does not prove that the certificate has not been revoked. OCSP was not checked."
},
{
"code": "ct",
"title": "Certificate Transparency",
"status": "unknown",
"message": "2 embedded Signed Certificate Timestamps (SCTs) found. Log signatures, operators and browser CT policy were not verified."
}
],
"score": 90,
"score_rules": [
{
"label": "Connection and trust",
"status": "pass",
"maximum": 50,
"points": 50
},
{
"label": "Hostname",
"status": "pass",
"maximum": 25,
"points": 25
},
{
"label": "Validity period",
"status": "warning",
"maximum": 25,
"points": 15
}
],
"error_code": null,
"diagnostic_error_code": null,
"measured_at": 1793102400,
"duration_ms": 42.6,
"host": "demo.example",
"scope": "final_host"
}
SEO basics
WarningScore: 90 / 100
Page title: Example TLS deployment guide
- title · First matching page title found. This does not assess search rankings.
- description · Meta description not found in the captured HTML.
- canonical · First matching canonical found. Its destination and duplicate declarations were not checked.
Details for SEO basics
Weight 20% · Effective 22.22% · seo-v1 · 13:00:00 CET
- Passed
title
First matching page title found. This does not assess search rankings.
Use a descriptive title that identifies this page’s purpose. Compare the fetched HTML with the rendered page and check for duplicate titles; presence alone does not assess quality.
- Warning
description
Meta description not found in the captured HTML.
Summarize what the visitor can do or learn on this page. Google may choose another snippet, so check the actual search appearance separately from the declared description.
- Passed
canonical
First matching canonical found. Its destination and duplicate declarations were not checked.
Open the canonical destination and confirm equivalent content. Keep internal links and the sitemap consistent with the preferred URL.
- Info
robots
An index, follow meta tag was found. HTTP and crawler-specific indexing instructions were not combined.
Check whether this page should be indexed. Review its HTML instructions and response headers, then confirm the actual state in Search Console.
- Passed
lang
The HTML language is en.
Match the document language to the visible content and mark passages in another language where needed. This scan reads the HTML attribute without assessing translation quality.
- Passed
viewport
A viewport meta tag was found.
Test the rendered page on a narrow screen, including tables, forms and navigation. A viewport declaration does not prove that the layout is usable on mobile.
- Info
social
No social metadata found. This metadata is optional.
Check the title, description and image used when the URL is shared. Social preview metadata is optional and is not a search ranking measurement.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[
{
"code": "title",
"weight": 40,
"status": "pass",
"points": 40
},
{
"code": "description",
"weight": 20,
"status": "warning",
"points": 10
},
{
"code": "canonical",
"weight": 20,
"status": "pass",
"points": 20
},
{
"code": "lang",
"weight": 10,
"status": "pass",
"points": 10
},
{
"code": "viewport",
"weight": 10,
"status": "pass",
"points": 10
}
]
Evidence and scope
{
"ruleset_version": "seo-v1",
"url": "https://demo.example/guides/tls?lang=[redacted]",
"fields": {
"title": "Example TLS deployment guide",
"description": null,
"canonical": "https://demo.example/guides/tls",
"robots": "index, follow",
"lang": "en",
"viewport": "width=device-width, initial-scale=1"
},
"social": {
"og:title": null,
"og:description": null,
"og:url": null,
"og:image": null,
"twitter:card": null,
"twitter:title": null,
"twitter:description": null,
"twitter:image": null
}
}
Robots and sitemap
Not checkedNo score available
- robots · Robots.txt is reachable. Sitemap references are listed but not visited.
- sitemap · The /sitemap.xml response exceeded the 1 MiB scan limit. This does not establish that the sitemap is invalid.
Details for Robots and sitemap
Weight 10% · Effective 0% · robots-v1 · 13:00:00 CET
- Passed
robots
Robots.txt is reachable. Sitemap references are listed but not visited.
A reachable robots.txt does not prove that every crawler is allowed to fetch this page. Inspect matching rules and keep noindex readable.
- Not checked
sitemap
The /sitemap.xml response exceeded the 1 MiB scan limit. This does not establish that the sitemap is invalid.
This measurement is incomplete. Use the explanation to check the outcome independently.
Check the submitted URL and the URLs inside the XML. This scan checks the conventional sitemap file, not Google’s fetch result or all referenced sitemaps.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[]
Evidence and scope
{
"ruleset_version": "robots-v1",
"robots": {
"http_status": 200,
"url": "https://demo.example/robots.txt",
"sitemaps": [
{
"url": "https://demo.example/sitemap-index.xml",
"external": false
}
]
},
"sitemap": {
"error_code": "body_limit"
}
}
DNS and mail
WarningScore: 61 / 100
- a · Found on this host. Presence does not prove correct configuration or mail delivery.
- aaaa · Not found on this host. This may be intentional.
- cname · Not found on this host. This may be intentional.
Details for DNS and mail
Weight 10% · Effective 11.11% · dns-v1 · 13:00:00 CET
- Passed
a
Found on this host. Presence does not prove correct configuration or mail delivery.
Check that the IPv4 addresses for the exact hostname lead to the intended public endpoint. A DNS record alone does not establish HTTP reachability or a valid TLS certificate.
- Info
aaaa
Not found on this host. This may be intentional.
If IPv6 is published, test that endpoint as well as IPv4. Missing AAAA records can be intentional; an unreachable published address can affect clients using IPv6.
- Info
cname
Not found on this host. This may be intentional.
Check that any alias resolves to the intended hosting service. A hostname may use address records directly, so an absent CNAME is not automatically an error.
- Warning
mx
Not found on this host. This may be intentional.
Review the exact host checked and its role. Missing mail records on a web subdomain can be intentional; presence does not prove mail delivery.
- Warning
spf
Not found on this host. This may be intentional.
Review the sending domain and the services authorized to send mail for it. This scan records presence on the exact host; it does not evaluate SPF mechanisms or authenticate a message.
- Warning
dmarc
Not found on this host. This may be intentional.
Review the policy for the actual mail domain and its alignment requirements. This scan does not evaluate parent-domain fallback, SPF/DKIM alignment or delivery outcomes.
- Passed
caa
Found on this host. Presence does not prove correct configuration or mail delivery.
CAA expresses which certificate authorities may issue certificates under applicable DNS rules. This presence check does not evaluate aliases, inherited policy, issuer authorization or DNSSEC.
- Info
scope
Only demo.example and its _dmarc record were checked in this example. DKIM selectors, parent policies and mail delivery are not evaluated.
Interpret DNS results for the exact hostname shown in the report. Mail policy and certificate issuance can involve other names and rules that this bounded scan does not evaluate.
Scoring
Headers, redirects and TLS use their own scoring rules. HTTP without TLS and verified invalid TLS score 0. SEO, robots and DNS use audit-v1: pass 100%, warning 50%, fail 0%. Info and unknown checks are excluded.
[
{
"code": "a",
"weight": 10,
"status": "pass",
"points": 10
},
{
"code": "mx",
"weight": 20,
"status": "warning",
"points": 10
},
{
"code": "spf",
"weight": 25,
"status": "warning",
"points": 12.5
},
{
"code": "dmarc",
"weight": 25,
"status": "warning",
"points": 12.5
},
{
"code": "caa",
"weight": 10,
"status": "pass",
"points": 10
}
]
Evidence and scope
{
"ruleset_version": "dns-v1",
"scope": "exact_host",
"host": "demo.example",
"records": {
"a": {
"count": 1,
"present": true
},
"aaaa": {
"count": 0,
"present": false
},
"cname": {
"count": 0,
"present": false
},
"mx": {
"count": 0,
"present": false
},
"spf": {
"count": 0,
"present": false
},
"dmarc": {
"count": 0,
"present": false
},
"caa": {
"count": 1,
"present": true
}
}
}
About this scan
Six checks for one page and host, in up to 30 seconds. External sitemaps are not visited. DNS records do not prove correct mail delivery.
This fixed example is public and does not expire. It contains fictional data, not a stored visitor scan.
A snapshot, not a security guarantee.