1. General Results, most used to calculate the result A name "2606:4700:4700::1111" is ipv6 address, public suffix is not defined A Good: All ip addresses are public addresses A Good: No cookie sent via http. A Good: All urls with http status 200/404 have a complete Content-Type header (MediaType / MediaSubType + correct charset) B https://[2606:4700:4700:0000:0000:0000:0000:1111]/ 2606:4700:4700::1111 Missing HSTS-Header B https://[2606:4700:4700:0000:0000:0000:0000:1111]/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de Missing HSTS-Header C Error - no version with Http-Status 200 E http://[2606:4700:4700:0000:0000:0000:0000:1111]/ 2606:4700:4700::1111 https://2606:4700:4700:0000:0000:0000:0000:1111/ Wrong redirect one domain http to other domain https. First redirect to https without new dns query, so the server can send the HSTS header. That's fundamental using HSTS (Http Strict Transport Security). First step: Add correct redirects http ⇒ https. Perhaps in your port 80 vHost something like "RewriteEngine on" + "RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]" (two rows, without the "). Don't add this in your port 443 vHost, that would create a loop. Then recheck your domain, should be Grade C. There is the rule to select one https version as preferred version. H Fatal error: No https - result with http-status 200, no encryption I https://[2606:4700:4700:0000:0000:0000:0000:1111]/ 2606:4700:4700::1111 Content problems or problems with resources included - http links, files doesn't exist, different Content-Type definitions. Check the Html-Content - Part. I https://[2606:4700:4700:0000:0000:0000:0000:1111]/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de Content problems or problems with resources included - http links, files doesn't exist, different Content-Type definitions. Check the Html-Content - Part. M https://[2606:4700:4700:0000:0000:0000:0000:1111]/ 2606:4700:4700::1111 Misconfiguration - main pages should never send http status 400 - 499 M https://[2606:4700:4700:0000:0000:0000:0000:1111]/ 2606:4700:4700::1111 Misconfiguration - main pages should never send http status 400 - 499 B No _mta-sts TXT record found (mta-sts: Mail Transfer Agent Strict Transport Security - see RFC 8461). Read the result of server-daten.de (Url-Checks, Comments, Connections and DomainServiceRecords) to see a complete definition. Domainname: _mta-sts.2606:4700:4700::1111 2. Header-Checks (alpha, started 2022-10-23, may be buggy / incomplete) A [2606:4700:4700:0000:0000:0000:0000:1111] 2606:4700:4700::1111 Referrer-Policy Ok: Header without syntax errors found: same-origin A X-Frame-Options Ok: Header without syntax errors found: SAMEORIGIN B Info: Header is deprecated. May not longer work in modern browsers. SAMEORIGIN. Better solution: Use a Content-Security-Policy Header with a frame-ancestors directive. DENY - use 'none', SAMEORIGIN - use 'self'. If you want to allow some domains to frame your page, add these urls. F [2606:4700:4700:0000:0000:0000:0000:1111] 2606:4700:4700::1111 Content-Security-Policy Critical: Missing Header: F [2606:4700:4700:0000:0000:0000:0000:1111] 2606:4700:4700::1111 X-Content-Type-Options Critical: Missing Header: F [2606:4700:4700:0000:0000:0000:0000:1111] 2606:4700:4700::1111 Permissions-Policy Critical: Missing Header: 3. DNS- and NameServer - Checks 4. Content- and Performance-critical Checks https://[2606:4700:4700:0000:0000:0000:0000:1111]/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de Fatal: Check of /.well-known/acme-challenge/random-filename has a http status 401 / 403 Not Allowed / Forbidden. A http status 404 - Not Found - is expected. Creating a Letsencrypt certificate via http-01 challenge may not work. Trouble creating a certificate? Use https://community.letsencrypt.org/ to ask. A Good: All script Elements (type text/javascript) and src-Attribute have a defer / async - Attribute. So loading and executing these JavaScripts doesn't block parsing and rendering the Html-Output. Warning: CSS / JavaScript found without GZip support. Send these ressources with GZip. 2 external CSS / JavaScript files without GZip found - 1 with GZip, 3 complete Warning: CSS / JavaScript files with a missing or too short Cache-Control header found. Browsers should cache and re-use these files. 3 external CSS / JavaScript files without Cache-Control-Header, 0 with Cache-Control, but no max-age, 3 with Cache-Control max-age too short (minimum 7 days), 0 with Cache-Control long enough, 6 complete. A Good: All checked attribute values are enclosed in quotation marks (" or '). A Info: No img element found, no alt attribute checked A Duration: 33510 milliseconds, 33.510 seconds