That is the address visitors actually land on, so the certificate, security headers, and public files were checked there. Some sites serve a different certificate on each address.
Nothing stood out. That is not a guarantee of safety — only public information was examined.
The domain has been maintained for a long time.
Certificates are renewed regularly, so a recent date on its own is normal.
Mail is properly configured too — not something hastily built sites usually bother with.
DNS records are managed here — this is where you log in to add or change them.
Requests pass through this layer before reaching the real server. It also hides the origin from visitors.
Estimated from the IP registration. A CDN in front makes the true origin invisible from outside, which is the safer arrangement.
This service handles mail for the domain. Follow its documentation when setting SPF and DMARC.
Plenty of validity left.
This domain is covered by the certificate.
Obsolete protocol versions are switched off.
A sender policy is published and closed off correctly.
Spoofed mail is quarantined or rejected.
Outgoing mail is signed, so recipients can verify it was not forged.
These servers receive mail for the domain.
Mail transport encryption is enforced, blocking downgrade attacks in transit.
Reports arrive when mail encryption fails, so problems get noticed.
Mail to this domain travels over an encrypted channel. Verified by connecting to the actual server.
Only the listed authorities may issue certificates for this domain.
DNS answers cannot be verified against tampering. Not mandatory, but worth enabling.
Most registrars enable DNSSEC with a single switch.
All four resolvers queried return the same address.
Without HSTS, a first visit over plain HTTP can be intercepted.
add_header Strict-Transport-Security "max-age=31536000" always;
No policy limits which scripts may run, which is the main defence against XSS.
add_header Content-Security-Policy "default-src 'self'" always;
Browsers may guess file types and execute something unintended.
add_header X-Content-Type-Options "nosniff" always;
Other sites cannot silently frame your pages.
Full URLs may leak to other sites when visitors click away.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
The server version is not advertised.
The first byte arrives quickly.
robots.txt is a public file. Paths listed here are not hidden — they are advertised to anyone who reads it.
Remove those lines. Block access at the web server (403/404) and use a noindex tag on pages you only want kept out of search.
A public contact is published for reporting security issues.
Search engines can find the page list directly.
The site still answers over unencrypted HTTP.
Return a 301 redirect from port 80 to the https address.
Registration has time left.
Only public information is read (DNS records, certificates, HTTP responses). Nothing is logged in, and no load is placed on the site.