HTTPS and certificates

Is the site encrypted?

Without HTTPS, anyone on the same network can read what your visitors type, passwords included. They can even change content, for example on hotel or café Wi-Fi. HTTPS means the connection between browser and server is encrypted. You recognize it by the padlock in the address bar.

We report “No HTTPS” when your site ends up on http after all redirects. That happens when you enter http:// and no redirect to https:// follows, or when https redirects back to http. The grade is then always F, no matter how good the rest is. If you type the address without http, we try https first. If no encrypted connection can be established at all, we check over http. If that fails too, you see an error message instead of a grade.

How to fix it: almost every host offers the certificate for free, usually from Let's Encrypt. Turn it on in your host’s control panel, along with the redirect from http to https. After that, the Strict-Transport-Security header is worth adding.

Redirect from http to https

Anyone who types your address without https or follows an old link lands on http:// first. If your server doesn’t redirect from there to https://, the visitor gets the page unencrypted. We open your homepage once over http:// for this, the way a browser does when you type the address, and only check whether a redirect to https follows. We don’t read the content. If the server answers over http with the page, we report a warning. If your site sets HSTS, it is only a notice, because browsers then send returning visitors to https themselves. If port 80 is closed, there is no finding. We skip this for platform addresses such as name.lovable.app, where the platform decides.

How to fix it: almost every hosting provider has a switch for this, often called “force HTTPS”. Otherwise one rule on the server is enough:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

The certificate

The certificate is your domain’s ID card. In the browser it stands behind the padlock. A certificate authority issues it, and it expires after a fixed period. While connecting, we read who issued it, how long it is valid and whether the browser would accept it.

• Invalid: it doesn’t match the domain, is self-signed or is set up incompletely. Browsers show a warning page.
• Expired: the expiry date has passed. Visitors see a warning page in this case too.
• Expiring soon: under 14 days this is a warning, under 30 days a notice.

If the certificate is invalid, fetching the site usually fails right away. You then get no grade, only the message that the site couldn’t be reached because of the certificate.

How to fix it: check with your host whether automatic renewal is turned on. Free certificates are valid for only a few months and normally renew themselves. If the notice stays, a change to the domain has often stopped the renewal, for example a move to another provider.

The encryption version

The technology behind HTTPS is called TLS, and it has versions. TLS 1.0 and 1.1 are considered insecure, and current browsers have turned them off. TLS 1.2 and 1.3 are current. The TLS guideline of Germany’s Federal Office for Information Security (BSI, TR-03116-4) requires at least TLS 1.2 and recommends TLS 1.3. We report an outdated version when our connection is made over TLS 1.0 or 1.1. If a server only supports these old versions, a connection usually fails completely. You then see an error message instead of a grade.

We don’t test whether your server still accepts the old versions alongside TLS 1.2. Specialized TLS tests can do that.

How to fix it: set at least TLS 1.2 in your server or hosting settings. In nginx it looks like this:

ssl_protocols TLSv1.2 TLSv1.3;

In Apache the line is SSLProtocol -all +TLSv1.2 +TLSv1.3. With managed hosts, you set this in the control panel or ask support.

Still have questions? Email us.