heroku.com

com. 1 are switched off. Beyond the handshake we pull the response headers (HSTS X-Content-Type-Options X-Frame-Options Content-Security-Policy and friends) to see whether the site enforces secure browsing once the connection is open.

We also check CAA DNS records which tell certificate authorities which CAs are even allowed to issue for the apex and we trace the http:// → https:// redirect because a missing redirect quietly disables the entire encryption story for users who type the URL without a scheme. com at the time of capture — not an inferred score from third-party feeds.

Certificates expire. An expired certificate produces a full-screen browser warning that destroys trust and drives users away within seconds — a single missed renewal can cost more than a year of marketing. 3 is mandatory for PCI-DSS workloads and meaningfully reduces handshake latency.

Security headers are the difference between transport encryption (good) and end-to-end browser hardening (great): HSTS prevents downgrade attacks even when a user types http:// and CSP shrinks XSS impact from site compromise to single page anomaly. com. Most domains we audit don't publish a CAA record; most domains that do get it wrong by listing too many CAs.

com but here's how to read the bands once you do. 2+ — but well short of grade A. The top 1000 domains by traffic average 92/100 the top 10 000 average 84/100 and a typical small business or hobby site lands around 64/100. The gap between the median and the top-1k cluster is almost entirely security-headers + CAA + HSTS-preload — none of which require paid infrastructure just configuration.

Worth noting: SSL Labs' grading scheme weighs differently than ours — they punish older protocols more harshly we punish missing headers more harshly. 85 but disagree on the margin. Run both for the full picture before a security review.

Treat the issues list above as a punch-list fix one a day re-run this audit after each change and you should reach grade A within a week of focused work. The high-leverage order in our experience auditing thousands of domains: (1) Fix any cert-expiry-soon warning immediately — switch to certbot or your CDN's auto-renew if you haven't.

1 if any are still listening — every modern web server has a single config line for this. org once you've verified every subdomain is HTTPS-only. (4) Add a CAA record listing only the CAs you actually use. (5) Run the bonus headers (Content-Security-Policy X-Content-Type-Options: nosniff Referrer-Policy Permissions-Policy) through our CSP and HTTP Headers tools — both linked below.

com so the overall SSL score and certificate-expiry threshold are checked on the cadence available to your plan. Review the stored result to identify any renewed certificate header or protocol regression.