That is the address visitors actually land on, so the certificate, security headers, and public files were checked there. Some sites serve a different certificate on each address.
Have a look at the items below. A signal does not prove anything is wrong, but it is reason enough to look twice before entering personal or payment details.
A site running normally today rarely lacks HTTPS. Do not enter personal or payment details on this address.
Mail is properly configured too — not something hastily built sites usually bother with.
DNS records are managed here — this is where you log in to add or change them.
Requests pass through this layer before reaching the real server. It also hides the origin from visitors.
Estimated from the IP registration. A CDN in front makes the true origin invisible from outside, which is the safer arrangement.
This service handles mail for the domain. Follow its documentation when setting SPF and DMARC.
Plenty of validity left.
This domain is covered by the certificate.
Obsolete protocol versions are switched off.
A sender policy is published and closed off correctly.
The policy only monitors — spoofed mail is still delivered.
Watch the reports for a few days, then raise the policy to p=quarantine.
Outgoing mail is signed, so recipients can verify it was not forged.
These servers receive mail for the domain.
Most mail is still encrypted without it, but nothing enforces it. Optional.
There is no channel to report failed mail encryption. Optional.
Mail may travel in plain text and could be read along the way.
Install a TLS certificate on the mail server and enable STARTTLS.
Any certificate authority in the world may issue a certificate for this name.
Add a CAA record, for example: 0 issue "letsencrypt.org"
DNS answers cannot be verified against tampering. Not mandatory, but worth enabling.
Most registrars enable DNSSEC with a single switch.
All four resolvers queried return the same address.
Without HSTS, a first visit over plain HTTP can be intercepted.
add_header Strict-Transport-Security "max-age=31536000" always;
No policy limits which scripts may run, which is the main defence against XSS.
add_header Content-Security-Policy "default-src 'self'" always;
Browsers may guess file types and execute something unintended.
add_header X-Content-Type-Options "nosniff" always;
Another site can frame your pages and trick users into clicking.
add_header X-Frame-Options "SAMEORIGIN" always;
Full URLs may leak to other sites when visitors click away.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
The server version is not advertised.
The first byte arrives quickly.
There is no official channel to report a vulnerability. Optional.
Search engines have to discover pages by following links.
Publish sitemap.xml and reference it from robots.txt with a Sitemap: line.
Plain HTTP requests are sent to the encrypted address.
Only public information is read (DNS records, certificates, HTTP responses). Nothing is logged in, and no load is placed on the site.