Website security check: SSL certificate, HTTPS and headers

1. 1

   TLS 1.0 and 1.1 still enabled

   The risk: These 1999 and 2006 versions have been dropped by browsers and are exposed to known attacks. Keeping them caps your grade at B.

   The fix: Allow only TLS 1.2 and TLS 1.3.

   SSLProtocol -all +TLSv1.2 +TLSv1.3

   ssl_protocols TLSv1.2 TLSv1.3;

   Re-run the audit: the B cap goes away.

2. 2

   HSTS missing

   The risk: Without HSTS, a visitor who types your address without “https” first connects in clear text: an attacker on the same network can hijack that first request.

   The fix: Add the Strict-Transport-Security header, first with a short duration, then one year once everything is checked. Only add includeSubDomains if all your subdomains serve HTTPS.

   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

   With HSTS and a clean configuration, an A+ grade becomes reachable.

3. 3

   Certificate about to expire

   The risk: An expired certificate triggers a blocking warning in every browser: for your visitors, the site is down.

   The fix: Automate renewal (Let’s Encrypt with certbot, or your host’s option), check that the scheduled task runs, and monitor the expiry date.

   sudo certbot renew --dry-run
   systemctl list-timers | grep certbot

   A regular audit flags the deadline well before the outage.

4. 4

   Missing security headers

   The risk: These headers tell the browser not to display your site inside a foreign frame, not to guess file types and to restrict script sources.

   The fix: Add the headers below. For Content-Security-Policy, start with Content-Security-Policy-Report-Only, because a policy that is too strict can break pages.

   Header always set X-Content-Type-Options "nosniff"
   Header always set X-Frame-Options "SAMEORIGIN"
   Header always set Referrer-Policy "strict-origin-when-cross-origin"
   Header always set Content-Security-Policy-Report-Only "default-src 'self'; frame-ancestors 'self'"

   add_header X-Content-Type-Options "nosniff" always;
   add_header X-Frame-Options "SAMEORIGIN" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Content-Security-Policy-Report-Only "default-src 'self'; frame-ancestors 'self'" always;

   On shared hosting, these Apache lines often work in the .htaccess file.

5. 5

   DMARC missing or too permissive

   The risk: Without DMARC, anyone can send emails that appear to come from your domain. It is the basis of fake supplier fraud.

   The fix: Publish an SPF record listing your legitimate senders, sign with DKIM, then publish DMARC in monitoring mode (p=none) before moving to quarantine and then reject.

   example.com.         TXT  "v=spf1 include:_spf.provider.example -all"
   _dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

   Gmail and Yahoo already require SPF, DKIM and DMARC from bulk senders.

6. 6

   Server version disclosed

   The risk: A “Server: Apache/2.4.41” or “X-Powered-By: PHP/8.1” header tells an attacker which known flaws to try first.

   The fix: Hide version numbers, and above all keep software up to date: hiding is no substitute for patching.

   ServerTokens Prod
   ServerSignature Off

   server_tokens off;

   expose_php = Off

   The finding disappears from the report at the next audit.

These snippets are starting points: adapt them to your configuration and keep a copy of the original before any change.

1. 1

   Create your account

   Free sign-up in one minute, no credit card. The BETATEST2026 launch offer adds free Kredits while it is active.

2. 2

   Enter the domain

   Your website, a customer’s or a supplier’s: any public website can be audited, with no ownership check.

3. 3

   Get the PDF report

   A+ to F grade, ranked findings and fixes. Fix, re-run the audit and watch the grade climb.