Open
Cached
·
just now
91/100
SECURITY SCORE
Certificate Information
Subject
CN=*.prodpad.com
Issuer
C=US, O=Amazon, CN=Amazon RSA 2048 M04
Valid From
January 02, 2026
Valid Until
January 30, 2027
375 days
Public Key
RSA
2048 bit
Adequate
Signature Algorithm
SHA256-RSA
SHA-256 Fingerprint
54:9A:8D:BA:37:85:05:12:32:85:2E:D4:A6:F8:6E:2F:60:37:84:48:56:BF:D7:29:48:91:99:49:FF:B5:F6:8C
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
TLS 1.3
Forward Secrecy
Supported
(Modern clients use PFS)
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=63072000
Content-Security-Policy
Basic
upgrade-insecure-requests; child-src; connect-src; +9 more
upgrade-insecure-requests; child-src 'self' *.prodpad.com prodpad2017.staging.wpengine.com calendly.com *.twitter.com www.youtube.com player.vimeo.com www.slideshare.net downloads.mailchimp.com s3.amazonaws.com; connect-src 'self' api.segment.io cdn.segment.com api.amplitude.com *.fullstory.com prodpad2017.wpengine.com api-widget.prodpad.com https://api.hubapi.com *.hubspot.com https://www.facebook.com https://hubspot-forms-static-embed.s3.amazonaws.com *.doubleclick.net *.google-analytics.com *.fontawesome.com *.cloudfront.net *.helpscout.net *.pusher.com wss://*.pusher.com *.sumologic.com *.hsforms.com https://pro.ip-api.com *.hs-banner.com forms.hscollectedforms.net *.analytics.google.com https://analytics.google.com px.ads.linkedin.com https://www.google.com/ccm/collect https://tracking-api.g2.com eu.i.posthog.com https://www.googleadservices.com https://www.google.co.uk/ads https://eu-assets.i.posthog.com/static/ https://static.hsappstatic.net/; default-src 'self' api.segment.io cdn.segment.com api.amplitude.com *.fullstory.com prodpad2017.wpengine.com; font-src 'self' *.prodpad.com fonts.gstatic.com fonts.googleapis.com data: *.fontawesome.com; frame-src *.twitter.com *.prodpad.com *.vimeo.com *.youtube.com calendly.com www.slideshare.net www.instagram.com https://optimize.google.com *.hubspot.com https://cards.producthunt.com https://www.facebook.com https://forms.hsforms.com https://venngage.net *.venngage.com *.zoom.us *.google.com https://www.youtube-nocookie.com/ td.doubleclick.net/ https://www.googletagmanager.com/ https://6306234.hs-sites.com/; img-src 'self' *.prodpad.com *.twitter.com *.prodpad2017.staging.wpengine.com *.gravatar.com data: *.google.com *.google.co.uk *.doubleclick.net *.googleadservices.net *.google-analytics.com *.twimg.com *.linkedin.com data: cdn-images.mailchimp.com https://optimize.google.com https://i.ytimg.com https://track.hubspot.com https://px.ads.linkedin.com https://www.facebook.com https://forms.hsforms.com https://forms.hubspot.com https://cdn2.hubspot.net *.w.org https://q.quora.com *.hubspot.com *.cloudfront.net *.adsymptotic.com perf.hsforms.com hi.hellobar.com forms-na1.hsforms.com https://perf-na1.hsforms.com https://6306234.fs1.hubspotusercontent-na1.net https://www.google.nl https://beacon-v2.helpscout.net https://www.googletagmanager.com https://static.hsappstatic.net; media-src 'self' *.prodpad.com prodpad2017.staging.wpengine.com *.twimg.com fonts.gstatic.com www.google-analytics.com js.intercomcdn.com *.helpscout.net; object-src 'self' *.prodpad.com prodpad2017.staging.wpengine.com calendly.com ext.prodpad.com platform.twitter.com www.youtube.com player.vimeo.com www.slideshare.net widget.intercom.io downloads.mailchimp.com s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.prodpad.com prodpad2017.staging.wpengine.com cdn.segment.com www.googletagmanager.com cdn.amplitude.com www.googleadservices.com d2wy8f7a9ursnm.cloudfront.net *.fullstory.com www.google-analytics.com googleads.g.doubleclick.net *.twitter.com downloads.mailchimp.com s3.amazonaws.com www.google-analytics.com *.twimg.com mc.us5.list-manage.com assets.calendly.com platform.instagram.com www.instagram.com tagmanager.google.com https://optimize.google.com https://static.hsappstatic.net https://www.youtube.com https://s.ytimg.com https://js.hs-analytics.net https://js.hs-scripts.com https://js.hsadspixel.net https://js.hscollectedforms.net https://connect.facebook.net https://snap.licdn.com https://js.hsforms.net https://forms.hsforms.com https://js.hsleadflows.net https://api.hubapi.com *.venngage.com *.usemessages.com *.fontawesome.com *.hs-banner.com *.hscta.net *.hubspot.com *.helpscout.net *.cloudflare.com js-na1.hs-scripts.com *.hellobar.com *.google.com/recaptcha/enterprise.js *.gstatic.com js.hsforms.net *.g2crowd.com js.hs-scripts.com eu-assets.i.posthog.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.twitter.com downloads.mailchimp.com *.prodpad.com tagmanager.google.com https://optimize.google.com *.fontawesome.com; form-action 'self' *.prodpad.com prodpad.us5.list-manage.com *.twitter.com calendly.com https://www.facebook.com https://forms.hsforms.com *.hubspot.com api.hsforms.com/submissions/v3/integration/submit/;
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports