A padlock does not tell you whether your certificate will renew tomorrow or whether a page can be embedded by an unrelated site. TLS and HTTP response policies solve different problems. Combining them in one practical review helps you find both urgent availability issues and missing defensive layers.
Sitelemetry's TLS module records certificate trust, validity information and the negotiated protocol. Its HTTP header module inspects an actual response and records the final URL, status and observed headers. Those observations are the starting point for a repair, not a claim that the application has been fully penetration-tested.
What this audit covers
What can be measured
- TLS trust outcome, certificate validity dates, issuer and negotiated protocol on the tested connection.
- Observed HSTS, CSP, framing protection, content-type protection, referrer policy and selected disclosure/CORS signals.
- Security attributes on cookies actually returned to the scan; successful checks where supported.
What it cannot prove
- One negotiated TLS version is not a complete enumeration of every protocol or cipher the server supports.
- A public response does not expose every authenticated cookie or route-specific policy.
- When TLS or networking prevents an HTTP response, headers remain unmeasured rather than automatically missing.
Run against an authorized, verified target. Your plan and selected profile determine included modules; additional TLS or security engines require their own availability. Read the report's coverage before comparing results.
Separate certificate failures from policy findings
An expired certificate can stop customers reaching the site immediately. A missing referrer policy usually has a different consequence and urgency. Start with the hostname, final redirect destination, certificate expiry and actual trust error. Check whether the problem affects the CDN edge, origin or only a particular hostname. A valid certificate on the apex domain does not automatically cover every subdomain.
The native TLS check flags observed legacy negotiation and warns when expiry approaches. It does not prove that every older protocol is disabled merely because the connection negotiated TLS 1.3. Consult your termination configuration and use an appropriately scoped protocol assessment when that assurance is required.
Prioritize findings by effect
| Finding | Typical priority | Useful evidence |
|---|---|---|
| Expired or untrusted certificate | High | Hostname, expiry and trust error |
| Certificate approaching expiry | Medium; urgency rises with remaining time | Remaining days and renewal status |
| HSTS, CSP or framing defense missing | Often medium; application context matters | Actual response headers and affected page |
| Missing nosniff or referrer policy | Usually low | Header value and served content type |
| Wildcard CORS on a public resource | Review in context | Resource sensitivity and intended consumers |
A missing CSP is not proof of XSS, and a present CSP is not proof that XSS is impossible. A wildcard CORS response can be intentional for public assets. For private data, investigate the actual authentication and origin behavior. Avoid translating every policy observation into a confirmed data breach.
Roll out Content Security Policy with evidence
Inventory scripts, fonts, images, connections, frames and payment providers. Test a candidate policy with Content-Security-Policy-Report-Only before enforcing it. Reporting mode helps identify breakage but does not block the reported actions. Configure an appropriate reporting destination if you need centralized reports.
Content-Security-Policy-Report-Only: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'This is an illustrative starting point, not a universal production policy. External services may need explicit sources, and script policies may require nonces or hashes. Exercise signup, OAuth popups, checkout, consent choices and error pages. Resolve legitimate violations, then switch the reviewed policy to the enforcing header. Do not add broad wildcards simply to silence every report.
Make HSTS a deliberate operational commitment
HSTS tells supporting browsers to use HTTPS for a remembered period. Before increasing that period, verify reliable HTTPS and certificate renewal. Begin with a controlled short duration, observe the rollout and expand it once the configuration is stable.
includeSubDomains affects subdomains too; check legacy services and delegated hosts before using it. Preloading is a separate commitment with browser-list requirements and a potentially slow removal process. Adding the word preload to a header does not itself submit the domain. Do not copy a long-duration, all-subdomains example into production solely to remove a scanner warning.
Check the response customers actually receive
Apply changes at the effective TLS terminator and response-producing layer. A correctly edited origin file may have no effect when the CDN overwrites headers. Conversely, duplicated policies from several layers can interact unexpectedly. Compare the final response for the homepage, login, application and relevant error routes rather than relying on one configuration file.
Use Secure and HttpOnly where appropriate for session cookies; choose SameSite according to the real cross-site flow. A JavaScript-readable preference cookie has different needs from a session token. nosniff belongs with correct MIME types. Remove unnecessary version disclosures, while recognizing that hiding a banner does not patch outdated software. OWASP's header guidance explains the separate controls.
Retest security and functionality together
- Confirm the intended hostname presents the trusted certificate and expected validity dates.
- Inspect the public response after redirects and cache updates; verify the actual policy values.
- Run signup, login, logout, payment and required embedding in supported browsers.
- Repeat the same Sitelemetry modules and review both findings and incomplete checks.
- Keep certificate-renewal monitoring and a tested rollback procedure for policy changes.
When a handshake fails intermittently, retain the error and repeat from another relevant network before declaring the entire site unavailable. A successful retest closes the observed issue, not every possible transport weakness. Use the OWASP TLS guidance for a broader configuration review.
Common questions
Does Report-Only remove the missing CSP finding?
It is a testing stage, not an enforcing CSP. The report may continue to flag missing enforcement until a working Content-Security-Policy header is deployed.
Should I enable HSTS preload immediately?
Only after checking all requirements, subdomain readiness and the operational consequences. It is not a safe default for every domain.
Why are headers unmeasured when the certificate fails?
A failed verified HTTPS request did not return usable headers. The TLS failure is evidence; absent HTTP evidence should not be converted into multiple missing-header claims.
Sources & further reading
- MDN: Content Security Policy reporting modedeveloper.mozilla.org
- MDN: HTTP Strict Transport Securitydeveloper.mozilla.org
- OWASP HTTP headers guidancecheatsheetseries.owasp.org
- OWASP Transport Layer Security guidancecheatsheetseries.owasp.org
Written by the Sitelemetry team, checked against the product’s audit scope and linked primary sources. Examples are illustrative unless an observed case is explicitly identified.
