HTTPS certificate validation
pass · info
A trusted certificate matching this hostname was validated using TLSv1.3.
Keep certificate renewal monitored; this does not test every TLS protocol or cipher.
2026-11-03T06:46:28.489852+00:00 · completed
FICTIONAL EXAMPLE. No website was contacted. A configuration baseline of one unauthenticated HTTPS HEAD response at /. No redirects followed. A HEAD response may differ from GET. This is not a penetration test or proof that a website is secure.
pass · info
A trusted certificate matching this hostname was validated using TLSv1.3.
Keep certificate renewal monitored; this does not test every TLS protocol or cipher.
pass · info
Certificate expires on 2026-12-31.
Ensure automated renewal succeeds before this date.
pass · info
One HSTS header with a positive max-age was observed.
After checking HTTPS compatibility, configure HSTS; only include subdomains you control.
review · low
A single enforcing CSP header was not observed.
Review a restrictive CSP against the application's real scripts and resources; header presence does not establish XSS protection.
not_assessed · info
No recognized single X-Frame-Options value was observed; CSP frame-ancestors may provide protection.
Review CSP frame-ancestors and, where appropriate, X-Frame-Options for the intended embedding policy.
pass · info
One nosniff directive was observed.
Serve correct Content-Type values and configure X-Content-Type-Options: nosniff.
observed · info
One Referrer-Policy header was observed; validity was not assessed.
Choose a referrer policy suitable for your privacy and navigation requirements.
SQL injection, XSS, SSRF, authentication, authorization, business logic, other pages and subdomains, old TLS protocol support
Contact TGG for a scoped assessment with human review.