Open
Cached
·
just now
94/100
SECURITY SCORE
Certificate Information
Subject
CN=saia.com
Issuer
C=US, O=Let's Encrypt, CN=E8
Valid From
January 06, 2026
Valid Until
April 06, 2026
74 days
Public Key
ECDSA
256 bit
(P-256)
Adequate
Signature Algorithm
ECDSA-SHA384
SHA-256 Fingerprint
4F:0E:8F:2A:3A:BF:32:FE:27:A9:56:57:2A:9B:8E:61:B1:5A:CE:70:08:E2:32:24:CB:0B:B1:23:D0:F2:A6:B2
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
TLS 1.3
Forward Secrecy
Supported
(Modern clients use PFS)
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=31536000; includeSubDomains
Content-Security-Policy
Good
default-src; style-src; script-src; +2 more
default-src 'self' *.saia.com *.saiasecure.com saiasecure.com *.gcs-web.com *.iexapis.com *.vimeo.com data: *.eum-appdynamics.com *.w3.org *.google.com cdn.contentful.com *.ctfassets.net *.advertising.com *.casalemedia.com *.rubiconproject.com *.outbrain.com *.yahoo.com *.pubmatic.com *.taboola.com *.rlcdn.com *.adnxs.com *.bidswitch.net *.3lift.com *.openx.net *.adroll.com fonts.googleapis.com *.googletagmanager.com fonts.gstatic.com *.mktoresp.com *.google-analytics.com *.linkedin.com *.google-analytics.co *.doubleclick.net *.adsymptotic.com *.facebook.com d.adroll.mgr.consensu.org *.tvsquared.com *.powerbi.com *.okta.com *.cookielaw.org *.onetrust.com *.gstatic.com *.site24x7static.com *.stackadapt.com *.qvdt3feo.com *.azurewebsites.net *.linkex.us 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 *.mountain.com; style-src 'self' *.doubleclick.net fonts.googleapis.com 'unsafe-inline' *.cookielaw.org *.onetrust.com *.google.com *.gstatic.com *.site24x7static.com *.stackadapt.com *.qvdt3feo.com *.azurewebsites.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 *.mountain.com; script-src 'self' *.appdynamics.com *.ipredictive.com *.analytics-sm.com analytics-sm.com *.adsymptotic.com *.adroll.com *.doubleclick.net *.consensu.org munchkin.marketo.net *.googletagmanager.com *.google-analytics.com *.google-analytics.co snap.licdn.com connect.facebook.net 614-yjx-388.mktoresp.com *.googleadservices.com collector-6453.tvsquared.com s.adroll.com *.clickdimensions.com *.cookielaw.org *.onetrust.com *.google.com *.gstatic.com 'unsafe-inline' *.site24x7static.com *.stackadapt.com *.qvdt3feo.com *.azurewebsites.net *.linkex.us 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 *.mountain.com; img-src 'self' data: *.saiasecure.com saiasecure.com *.saia.com *.google.com *.doubleclick.net *.openx.net *.rlcdn.com *.3lift.com *.adnxs.com *.bidswitch.net *.taboola.com *.outbrain.com *.yahoo.com *.rubiconproject.com *.pubmatic.com *.advertising.com *.casalemedia.com *.linkedin.com *.w3.org *.tvsquared.com *.google-analytics.com *.google-analytics.co *.adroll.com *.facebook.com *.ctfassets.net analytics-sm.com *.adsymptotic.com *.analytics-sm.com *.ipredictive.com *.cookielaw.org *.onetrust.com *.gstatic.com *.site24x7static.com *.stackadapt.com *.qvdt3feo.com *.azurewebsites.net *.linkex.us 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 *.mountain.com; form-action 'self' *.facebook.com
X-Frame-Options
Excellent
DENY
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
no-referrer
Permissions-Policy
Present
geolocation=(*);
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Strengthen CSP by removing 'unsafe-eval'
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports