Blog · Website and TLS
Website, TLS and browser security
A padlock means the connection is encrypted to somebody. It does not mean the site is trustworthy, patched or safe. These guides separate the reassurance from the things that are actually verifiable from outside.
Website security conversations tend to collapse two different questions: is the connection private, and is the site well built? TLS answers the first. Response headers, redirect behaviour and certificate hygiene start to answer the second, and all of them are visible in a single unauthenticated request.
None of this replaces a code review or a penetration test. What it does is catch the misconfigurations that were never a decision — the missing HSTS header, the certificate covering the wrong hostname, the HTTP version of a page that quietly still works.
Every post in this cluster ends with the same question: what would you do on Monday? Where a check can be run by hand, the command is in the post. Where it cannot, the post says so rather than implying a tool will handle it.
Reference article
For the specification-level detail behind these guides — mechanisms, edge cases and what the standard does not cover:
Six security misconfigurations that are visible from outsideWhat the tool checks
The controls this cluster maps to.
Pulled from the published 22-control catalog, with the weights that drive the posture score.
| Control | What is evaluated |
|---|---|
| TLS protocol versions | Whether obsolete protocols are still negotiable on the public endpoint. |
| Certificate validity | Expiry, chain and whether the hostname is actually covered. |
| Cipher suites | Whether forward secrecy is available and legacy suites are disabled. |
| HTTPS redirect path | Whether plain HTTP redirects to HTTPS, and whether it leaks the path first. |
| Security headers | HSTS, CSP, framing and MIME-sniffing protection, referrer and permissions policy. |
Other clusters
Keep going elsewhere
Check this area on your own domain.
The assessment covers all five clusters, with the observation quoted behind every conclusive finding.