Security

The TLS certificate is refused by browsers

Install a certificate that is current, issued for this hostname and signed by a public authority; until then every visitor and every search engine meets a warning page instead of the site.

This site's certificate is refused by browsers. Instead of the page the reader sees a full-screen "your connection is not private" warning and a back button. Most go back. Google sees it too and treats pages with an invalid certificate as unreachable. Usually it is a certificate that expired, one issued for another domain name (bare, when the site runs on www), or an incomplete chain. For today: renew or fix the certificate; with Let's Encrypt, find out why it did not renew itself.

Id

SSL_CERT_INVALID

Fix estimate

30 min per page

The server lists a directory instead of serving a page

Turn off automatic directory indexes on the server: the listing names files that were never meant to be addresses.

Id

DIRECTORY_LISTING_EXPOSED

Fix estimate

15 min per page

A form on a secure page posts over http

Point the form’s action at the https address: browsers warn before sending it and Chrome refuses outright, so the form is both unsafe and broken.

Id

INSECURE_FORM_ACTION

Fix estimate

15 min per page

A string that looks like a live key is in the page source

Revoke the key, issue a new one and keep it on the server — the page source is public, so never print a secret into HTML or inline JavaScript.

The page code contains a string that looks like a live access key: to an API, a payment service, a database. Anyone who clicks "view source" can read the page code, so such a key is no longer secret. If it is active, someone can use it at your cost or in your name as soon as they find it, and automated scanners find it within hours. This is not an SEO matter and does not wait a week: revoke the key, issue a new one, and keep it on the server side.

Id

SECRET_IN_HTML

Fix estimate

30 min per page

TLS certificate expiring soon

Renew the certificate and confirm automatic renewal is running: when it lapses, every browser blocks the site outright.

This site's certificate expires soon. While it is valid nothing happens; on the day it expires every browser starts showing a warning instead of the page, and Google stops reading it. Modern certificates renew themselves, so if this one is nearing its end, the automation has probably stopped working: the server changed, the DNS changed, or someone switched the job off. Check now, while there is still time.

Id

SSL_CERT_EXPIRING

Fix estimate

20 min per page

Content Security Policy blocks a resource the page uses

Add the blocked source to the Content-Security-Policy header, or stop loading it; the page currently runs without it.

Id

CSP_BLOCKS_RESOURCE

Fix estimate

30 min per page

Cookies set without Secure, HttpOnly or SameSite

Set Secure, HttpOnly and SameSite on the cookies the site issues, so they cannot travel over http, be read by a script, or be sent from another site.

Id

INSECURE_COOKIE_FLAGS

Fix estimate

20 min per page

No contact, about or privacy page

Publish and link a contact page, an about page and a privacy policy: buyers and quality raters both look for them first.

Id

MISSING_TRUST_PAGES

Fix estimate

20 min per page

Mixed content on a secure page

Change http:// asset URLs (images, scripts, styles) to https:// so browsers stop warning.

Id

MIXED_CONTENT

Fix estimate

10 min per page

Redirect passes through plain http

Send every hop straight to its https address; a chain that ends secure can still travel in the clear.

Id

REDIRECT_DOWNGRADES_TO_HTTP

Fix estimate

10 min per page

The server does not send its full certificate chain

Configure the server to send the intermediate certificate along with its own; Chrome fetches it on its own, older phones and many tools do not.

Id

SSL_CHAIN_INCOMPLETE

Fix estimate

20 min per page

No verifiable business details on the site

Put a phone number, a postal address and a company or VAT number where a reader can see them, usually in the footer.

Id

MISSING_BUSINESS_IDENTITY

Fix estimate

15 min per page

Missing security header

Id

MISSING_SECURITY_HEADER

Fix estimate

15 min per page

Server reveals software version details

Hide the server version and X-Powered-By header — version strings help attackers pick exploits.

Id

SERVER_SIGNATURE_EXPOSED

Fix estimate

10 min per page