yourwebsite.comhandshake checked today at 09:41 UTC
Security is at 97, and the certificate expires in six days.
8 of the 10 checks below pass. The one thing with a date on it is the certificate: after 21 August every visitor sees a browser warning instead of your site.
Certificate
Checked hourly
6days of validity left
Renew this week- Common name
- yourwebsite.com
- Issuer
- Let's Encrypt R3
- Valid until
- 21 Aug 2026, 09:14 UTC
- Auto-renewal
- not confirmed
Open issues
Security
The SSL certificate expires in six days
The certificate for yourwebsite.com expires on 21 August. Visitors will see a browser warning after that.
Next step
Renew it, then check that auto-renewal is actually running.
Evidence
CN=yourwebsite.com · issuer Let's Encrypt R3 · notAfter 2026-08-21T09:14:00Z
yourwebsite.comfirst seen 6 days ago
Two images load over plain HTTP
Browsers block them on an HTTPS page, so both appear as gaps in the article layout.
Next step
Request both over HTTPS, or host the two files yourself.
Evidence
http://cdn.partner-site.com/logo.png · http://cdn.partner-site.com/badge.png · blocked: mixed-content
/blog/partnersfirst seen 5 days ago
Referrer-Policy is not set
The full URL of your pages is sent to every external site a visitor clicks through to, including query strings.
Next step
Set referrer-policy: strict-origin-when-cross-origin explicitly.
Evidence
referrer-policy header absent on all responses · default: strict-origin-when-cross-origin varies by browser
yourwebsite.comfirst seen 16 days ago
No critical security issues.
Nothing is currently exploitable: the certificate is still valid, the connection is encrypted end to end, and no page mixes HTTP content into an HTTPS page.
Checklist
8 pass · 1 not set
Response headers
- Pass: strict-transport-securitymax-age=31536000
Browsers refuse to load your site over plain HTTP for a year after the first visit.
- Pass: content-security-policydefault-src 'self'
Scripts can only be loaded from your own origin. Added in yesterday's header fix.
- Pass: x-content-type-optionsnosniff
Stops the browser guessing a file's type and running an upload as a script.
- Pass: referrer-policystrict-origin-when-cross-origin
Outbound links carry the domain a visitor came from, never the full path.
- Not set: permissions-policynot set
Embedded third-party frames can ask for the camera, microphone and location. Nothing on your site uses any of them, so this is a header you can set and forget.
Transport
- Pass: TLS 1.3negotiated
The handshake Tenvey made this morning used the current protocol version.
- For information: TLS 1.2accepted
Still offered as a fallback. Needed for older Android devices — drop it once they stop appearing in your analytics.
- Pass: TLS 1.1 and belowrefused
The protocol versions with known breaks are turned off.
- Pass: Cipher suiteTLS_AES_256_GCM_SHA384
Forward secrecy, so a stolen key cannot decrypt yesterday's traffic.
- Pass: HTTP redirect301 to https
Every plain-HTTP request is moved to the encrypted origin before anything is sent.
Fixed since last week
Yesterday, 09:12
Security improved from 91 to 97 after the header fix.
Content-Security-Policy and Strict-Transport-Security are now set on every response.
strict-transport-security: max-age=31536000 · content-security-policy: default-src 'self'