| 1. General Results, most used to calculate the result |
| A | name "2a02:4780:10:4205::1" is ipv6 address, public suffix is not defined
|
| A | Good: All ip addresses are public addresses
|
| A | Good: one preferred version: non-www is preferred
|
| A | Good: No cookie sent via http.
|
| A | Good: Some urls with http status 200/404 have a complete Content-Type header (MediaType / MediaSubType + correct charset):0 complete Content-Type - header (4 urls)
|
| http://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Url with incomplete Content-Type - header - missing charset
|
| https://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Url with incomplete Content-Type - header - missing charset
|
| http://2a02:4780:10:4205::1/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 2a02:4780:10:4205::1
|
| Url with incomplete Content-Type - header - missing charset
|
| https://[2a02:4780:0010:4205:0000:0000:0000:0001]/ 2a02:4780:10:4205::1
|
| Url with incomplete Content-Type - header - missing charset
|
| B | https://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Missing HSTS-Header
|
| H | Fatal error: http result with http-status 200, no encryption. Add a redirect http ⇒ https, so every connection is secure. Perhaps in your port 80 vHost something like "RewriteEngine on" + "RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]" (two rows, without the "). Don't add this in your port 443 vHost, that would create a loop.
|
| J | https://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Fatal: Control Panel error message. Ask your hoster. There is a cPanel-Redirect to the SORRY-page /cgi-sys/defaultwebpage.cgi with additional instructions.
|
| J | https://[2a02:4780:0010:4205:0000:0000:0000:0001]/ 2a02:4780:10:4205::1
|
| Fatal: Control Panel error message. Ask your hoster. There is a cPanel-Redirect to the SORRY-page /cgi-sys/defaultwebpage.cgi with additional instructions.
|
| N | https://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Error - Certificate isn't trusted, RemoteCertificateNameMismatch
|
| N | https://[2a02:4780:0010:4205:0000:0000:0000:0001]/ 2a02:4780:10:4205::1
|
| Error - Certificate isn't trusted, RemoteCertificateNameMismatch
|
| B | No _mta-sts TXT record found (mta-sts: Mail Transfer Agent Strict Transport Security - see RFC 8461). Read the result of server-daten.de (Url-Checks, Comments, Connections and DomainServiceRecords) to see a complete definition. Domainname: _mta-sts.2a02:4780:10:4205::1
|
| 2. Header-Checks |
| F | codedragon.dev 2a02:4780:10:4205::1
| Content-Security-Policy
| Critical: Missing Header:
|
| F | codedragon.dev 2a02:4780:10:4205::1
| X-Content-Type-Options
| Critical: Missing Header:
|
| F | codedragon.dev 2a02:4780:10:4205::1
| Referrer-Policy
| Critical: Missing Header:
|
| F | codedragon.dev 2a02:4780:10:4205::1
| Permissions-Policy
| Critical: Missing Header:
|
| B | codedragon.dev 2a02:4780:10:4205::1
| Cross-Origin-Embedder-Policy
| Info: Missing Header
|
| B | codedragon.dev 2a02:4780:10:4205::1
| Cross-Origin-Opener-Policy
| Info: Missing Header
|
| B | codedragon.dev 2a02:4780:10:4205::1
| Cross-Origin-Resource-Policy
| Info: Missing Header
|
| 3. DNS- and NameServer - Checks |
| 4. Content- and Performance-critical Checks |
| A | Good: All checks /.well-known/acme-challenge/random-filename without redirects answer with the expected http status 404 - Not Found. Creating a Letsencrypt certificate via http-01 challenge should work. If it doesn't work: Check your vHost configuration (apachectl -S, httpd -S, nginx -T). Every combination of port and ServerName / ServerAlias (Apache) or Server (Nginx) must be unique. Merge duplicated entries in one vHost. If you use an IIS, extensionless files must be allowed in the /.well-known/acme-challenge subdirectory. Create a web.config in that directory. Content: <configuration><system.webServer><staticContent><mimeMap fileExtension="." mimeType="text/plain" /></staticContent></system.webServer></configuration>. If you have a redirect http ⇒ https, that's ok, Letsencrypt follows such redirects to port 80 / 443 (same or other server). There must be a certificate. But the certificate may be expired, self signed or with a not matching domain name. Checking the validation file Letsencrypt ignores such certificate errors. Trouble creating a certificate? Use https://community.letsencrypt.org/ to ask.
|
| A | Good: No https + http status 200 with inline CSS / JavaScript found
|
| A | Good: Every https result with status 200 has a minified Html-Content with a quota lower then 110 %.
|
| https://2a02:4780:10:4205::1/ 2a02:4780:10:4205::1
|
| Warning: Https connections (Standard Port 443) found without support of the http/2 protocol via ALPN. Http/2 is the new Http-Version (old: http 1.1) with some important new features. Update your server software so http/2 is available. Only one TCP-connection per Server (that's a performance boost), Header-Compression and Server Pushs are available. Domain Sharding and Inline-CSS/Javascript shouldn't used with http/2.
|
| https://[2a02:4780:0010:4205:0000:0000:0000:0001]/ 2a02:4780:10:4205::1
|
| Warning: Https connections (Standard Port 443) found without support of the http/2 protocol via ALPN. Http/2 is the new Http-Version (old: http 1.1) with some important new features. Update your server software so http/2 is available. Only one TCP-connection per Server (that's a performance boost), Header-Compression and Server Pushs are available. Domain Sharding and Inline-CSS/Javascript shouldn't used with http/2.
|
| Warning: Svg-Images greater 1024 Bytes without internal compression are found. Svg is an Xml-Application, so Compression is required to reduce the size of the file. 1 images (type image/svg+xml, image/x-icon, image/vnd.microsoft.icon) found without compression.
|
| A | Good: All images with internal compression not compressed. Some Images (.png, .jpg, .jpeg, .webp, .gif) are already compressed, so an additional compression isn't helpful. 1 images (type image/png, image/jpg, image/jpeg, image/webp, image/gif) found without additional Compression. Not required because these images are already compressed
|
| Warning: Images with a missing or too short Cache-Control header found. Browsers should cache and re-use these files. 2 image files without Cache-Control-Header, 0 with Cache-Control, but no max-age, 0 with Cache-Control max-age too short (minimum 7 days), 0 with Cache-Control long enough, 2 complete.
|
| A | Good: All checked attribute values are enclosed in quotation marks (" or ').
|
| A | Good: Some img-elements have a valid alt-attribute.: 2 img-elements found, 1 img-elements with correct alt-attributes (defined, not an empty value).
|
| Wrong: img-elements without alt-attribute or empty alt-attribute found. The alt-attribute ("alternative") is required and should describe the img. So Screenreader and search engines are able to use these informations.: 1 img-elements without alt-attribute, 0 img-elements with empty alt-attribute found.
|
| A | Duration: 156814 milliseconds, 156.814 seconds
|
%22%20style=%22background-color:rgb(255,255,255)%22%3e%3c/svg%3e)