| 1. General Results, most used to calculate the result |
| A | name "2a01:4f8:1c1c:2139::2" is ipv6 address, public suffix is not defined
|
| A | Good: All ip addresses are public addresses
|
| A | Good: destination is https
|
| A | Good - only one version with Http-Status 200
|
| A | Good: one preferred version: non-www is preferred
|
| A | Good: No cookie sent via http.
|
| A | Good: All urls with http status 200/404 have a complete Content-Type header (MediaType / MediaSubType + correct charset)
|
| B | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
|
| Missing HSTS-Header
|
| B | https://photos.mavridis.uk/
|
| Missing HSTS-Header
|
| B | https://photos.mavridis.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
|
| Missing HSTS-Header
|
| B | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| PHPSESSID=976ea15713e62731acd04fea09512645; path=/
| Cookie sent via https, but not marked as secure
|
| B | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| PHPSESSID=976ea15713e62731acd04fea09512645; path=/
| Cookie without a SameSite-Attribute. Possible values are: Strict/Lax/None. Cookie may not work as expected, if "None" is wanted, but browsers use "Lax" as default value.
|
| E | http://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| https://photos.mavridis.uk/
| Wrong redirect one domain http to other domain https. First redirect to https without new dns query, so the server can send the HSTS header. That's fundamental using HSTS (Http Strict Transport Security). First step: Add correct redirects http ⇒ https. Perhaps in your port 80 vHost something like "RewriteEngine on" + "RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]" (two rows, without the "). Don't add this in your port 443 vHost, that would create a loop. Then recheck your domain, should be Grade C. There is the rule to select one https version as preferred version.
|
| N | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| https://2a01:4f8:1c1c:2139::2/login
| Error - Certificate isn't trusted, RemoteCertificateNameMismatch
|
| R | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| https://2a01:4f8:1c1c:2139::2/login
| Redirect to not existing domain
|
| R | https://[2a01:04f8:1c1c:2139:0000:0000:0000:0002]/ 2a01:4f8:1c1c:2139::2
| https://2a01:4f8:1c1c:2139::2/login
| Redirect to not existing domain
|
| B | No _mta-sts TXT record found (mta-sts: Mail Transfer Agent Strict Transport Security - see RFC 8461). Read the result of server-daten.de (Url-Checks, Comments, Connections and DomainServiceRecords) to see a complete definition. Domainname: _mta-sts.2a01:4f8:1c1c:2139::2
|
| 2. Header-Checks |
| F | photos.mavridis.uk
| Content-Security-Policy
| Critical: Missing Header:
|
| F | photos.mavridis.uk
| X-Content-Type-Options
| Critical: Missing Header:
|
| F | photos.mavridis.uk
| Referrer-Policy
| Critical: Missing Header:
|
| F | photos.mavridis.uk
| Permissions-Policy
| Critical: Missing Header:
|
| B | photos.mavridis.uk
| Cross-Origin-Embedder-Policy
| Info: Missing Header
|
| B | photos.mavridis.uk
| Cross-Origin-Opener-Policy
| Info: Missing Header
|
| B | photos.mavridis.uk
| Cross-Origin-Resource-Policy
| Info: Missing Header
|
| 3. DNS- and NameServer - Checks |
| 4. Content- and Performance-critical Checks |
| https://photos.mavridis.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
|
| Warning: Not existing ACME-file, but Server sends 200, not 404 or redirect. May be a problem creating a Letsencrypt certificate. Checking /.well-known/acme-challenge/random-filename - a http status 404 - Not Found - is expected. If your server sends content and a http status 200, the validation file (87 bytes, token, dot and the hash of the public part of the account key) may be invisible, so Letsencrypt can't validate your domain. If it is an application that sends this content, perhaps create an exception, so /.well-known/acme-challenge sends raw files. Or create a redirect to another domain and / or port 443, but your Letsencrypt client must support such a solution. Certbot: Use webroot as authenticator - https://certbot.eff.org/docs/using.html Trouble creating a certificate? Use https://community.letsencrypt.org/ to ask.
|
| A | Good: Every https result with status 200 and greater 1024 Bytes is compressed (gzip, deflate, br checked).
|
| https://photos.mavridis.uk/
|
| Warning: Https + http status 200 + Inline CSS / JavaScript found. Don't use inline CSS / JavaScript. These are compiled and re-used ressources, save these with a long Cache-Control max-age - header.
|
| https://photos.mavridis.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
|
| Warning: Https + http status 200 + Inline CSS / JavaScript found. Don't use inline CSS / JavaScript. These are compiled and re-used ressources, save these with a long Cache-Control max-age - header.
|
| https://photos.mavridis.uk/
|
| Warning: Https result with status 200 found, Html-Content is too big. Should be max. 110 %. May contain inline CSS / JavaScript, too much comments or white space. Re-used ressources - create files with a long Cache-Control max-age header. Remove comments and white space.
|
| https://photos.mavridis.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
|
| Warning: Https result with status 200 found, Html-Content is too big. Should be max. 110 %. May contain inline CSS / JavaScript, too much comments or white space. Re-used ressources - create files with a long Cache-Control max-age header. Remove comments and white space.
|
| https://photos.mavridis.uk/
|
| Warning: Https connections (Standard Port 443) found without support of the http/2 protocol via ALPN. Http/2 is the new Http-Version (old: http 1.1) with some important new features. Update your server software so http/2 is available. Only one TCP-connection per Server (that's a performance boost), Header-Compression and Server Pushs are available. Domain Sharding and Inline-CSS/Javascript shouldn't used with http/2.
|
| https://photos.mavridis.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
|
| Warning: Https connections (Standard Port 443) found without support of the http/2 protocol via ALPN. Http/2 is the new Http-Version (old: http 1.1) with some important new features. Update your server software so http/2 is available. Only one TCP-connection per Server (that's a performance boost), Header-Compression and Server Pushs are available. Domain Sharding and Inline-CSS/Javascript shouldn't used with http/2.
|
| Warning: CSS / JavaScript files with a missing or too short Cache-Control header found. Browsers should cache and re-use these files. 2 external CSS / JavaScript files without Cache-Control-Header, 0 with Cache-Control, but no max-age, 0 with Cache-Control max-age too short (minimum 7 days), 0 with Cache-Control long enough, 2 complete.
|
| A | Good: All checked attribute values are enclosed in quotation marks (" or ').
|
| A | Info: No img element found, no alt attribute checked
|
| A | Duration: 52624 milliseconds, 52.624 seconds
|
%22%20style=%22background-color:rgb(255,255,255)%22%3e%3c/svg%3e)