Question 1

Which HTTP security headers are checked?

Accepted Answer

The tool checks the critical headers: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and X-XSS-Protection. Each header is assessed with an optimal configuration recommendation.

Question 2

What does a certificate with SHA-1 or TLS 1.0 mean?

Accepted Answer

SHA-1 is a deprecated cryptographic algorithm, vulnerable to collision attacks. TLS 1.0 and 1.1 are disabled by modern browsers. The tool identifies these weak configurations and recommends migrating to TLS 1.3 with SHA-256 or SHA-384.

Question 3

Can the tool analyze internal servers?

Accepted Answer

The analysis requires the domain to be reachable from your browser. For internal servers (intranet, lab), make sure you're connected to the relevant network. Analysis data stays local and never passes through our servers.