Open
Cached
·
just now
92/100
SECURITY SCORE
Certificate Information
Subject
CN=opencollective.com
Issuer
C=US, O=Google Trust Services, CN=WE1
Valid From
January 09, 2026
Valid Until
April 09, 2026
78 days
Public Key
ECDSA
256 bit
(P-256)
Adequate
Signature Algorithm
ECDSA-SHA256
SHA-256 Fingerprint
DF:DB:FD:0C:14:E6:5D:E4:F6:3A:60:A2:A2:04:E4:50:AD:99:43:4D:E4:4E:12:07:7F:CB:A8:DF:0E:23:3E:68
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
TLS 1.3
Forward Secrecy
Supported
(Modern clients use PFS)
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=31536000; includeSubDomains
Content-Security-Policy
Good
block-all-mixed-content; default-src; img-src; +6 more
block-all-mixed-content; default-src 'self' https://cdn.plaid.com/; img-src 'self' https://images.opencollective.com https://next-images.opencollective.com https://pdf.opencollective.com data: *.paypal.com *.paypalobjects.com opencollective.com blog.opencollective.com blob: i.ytimg.com storage.googleapis.com cdn-logos.gocardless.com opencollective-production.s3.us-west-1.amazonaws.com opencollective-production.s3-us-west-1.amazonaws.com; worker-src 'self'; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com; connect-src 'self' https://opencollective-prod-api.herokuapp.com https://pdf.opencollective.com https://rest.opencollective.com https://ml.opencollective.com https://oficollective.com https://oscollective.org wtfismyip.com *.paypal.com *.paypalobjects.com sentry.io *.sentry.io atlas.shopifycloud.com atlas.shopifysvc.com country-service.shopifycloud.com maps.googleapis.com https://wise.com https://transferwise.com https://sandbox.transferwise.tech https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com https://www.google.com https://api.cryptonator.com https://plausible.io opencollective-production.s3.us-west-1.amazonaws.com opencollective-production.s3-us-west-1.amazonaws.com https://production.plaid.com/; script-src 'self' 'nonce-170ae756-5bdb-4fab-864c-ac38d8073ffd' maps.googleapis.com js.stripe.com *.paypal.com *.paypalobjects.com https://hcaptcha.com https://js.hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com https://www.google.com https://plausible.io https://cdn.plaid.com/link/v2/stable/link-initialize.js; frame-src blob: www.youtube.com www.youtube-nocookie.com opencollective.com anchor.fm podcasters.spotify.com player.vimeo.com js.stripe.com *.paypal.com *.openstreetmap.org https://wise.com https://transferwise.com https://sandbox.transferwise.tech https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com https://www.google.com https://cdn.plaid.com/; object-src opencollective.com
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
no-referrer
Permissions-Policy
Missing
Not configured
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Strengthen CSP by removing 'unsafe-eval'
- • Consider adding Permissions-Policy to control browser features
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports