Security
The certificate, the headers, and the paths that answer.
Tenvey re-reads all three every six hours from outside your network, which is the only place a visitor ever stands. Nothing is installed on the server.
Six days is a warning, not a footnote.
A first notice opens 30 days out, a second at 14. At 7 days the certificate moves to the top of the issue list and stays there, because the failure mode is not a slow page — it is a full-screen browser warning.
Certificate · yourwebsite.com
Expires in 6 days- Common name
- yourwebsite.com
- Issuer
- Let's Encrypt R3
- Not after
- 21 Aug 2026, 09:14 UTC
- Days left
- 6
CN=yourwebsite.com · issuer Let's Encrypt R3 · notAfter 2026-08-21T09:14:00Z
Next step
Renew it, then check that auto-renewal is actually running.
Headers are set or they are not.
- strict-transport-securitymax-age=31536000Set
- content-security-policydefault-src 'self'Set
- x-content-type-optionsnosniffSet
- referrer-policy—Not set
- permissions-policy—Not set
Security improved from 91 to 97 after the header fix.
Content-Security-Policy and Strict-Transport-Security are now set on every response.
The 3 points still missing are the two headers at the bottom of that list. Tenvey names them rather than reporting 97 and leaving you to guess what the rest was.
Paths that should not answer.
Every sweep requests a fixed list of paths that leak when a build step goes wrong. Anything other than a 404 or a 403 opens as critical, because a readable .env is not a warning.
The same pass looks for directory listings, assets still loading over plain HTTP on an HTTPS page, and response headers that name your framework and its version.
Exposure sweep
09:41
- /.env404
- /.git/config404
- /backup.sql404
- /server-status403
- /wp-admin/404
Nothing reachable. The next sweep runs in four hours.
Also watched