SSL Verification Bypassed
The server's SSL certificate could not be verified. The analysis was completed using insecure mode. Data may be less reliable.
Reason:
Hostname Mismatch - certificate is issued for admin.clickomart.navybits.com, not for staging.navybits.com
Open
Cached
·
just now
82/100
SECURITY SCORE
Certificate Information
Subject
CN=admin.clickomart.navybits.com
Issuer
C=US, O=Let's Encrypt, CN=R12
Valid From
January 02, 2026
Valid Until
April 02, 2026
77 days
Public Key
RSA
2048 bit
Adequate
Signature Algorithm
SHA256-RSA
SHA-256 Fingerprint
D8:86:A1:79:D1:B3:5B:FB:32:E7:D8:1C:EE:11:57:54:94:92:82:91:05:83:41:9B:B6:D0:2F:68:70:A1:03:51
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
Forward Secrecy
Limited
(Check cipher configuration)
Warnings
- • TLS 1.3 is not supported (recommended)
HTTP Security Headers
Status
Strict-Transport-Security
Missing
Not configured
Content-Security-Policy
Basic
default-src; script-src; connect-src; +4 more
default-src 'self' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com; script-src 'self' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com 'unsafe-eval'; connect-src * 'self' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com; img-src data: 'self' https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://images1-focus-opensocial.googleusercontent.com https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com blob:; style-src 'self' 'unsafe-inline' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com; font-src 'self' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com; media-src blob: 'self' data: https://cdn.quilljs.com http://*.googleapis.com https://*.googleapis.com http://*.gstatic.com https://*.gstatic.com http://www.geoplugin.net https://geoip.nekudo.com/api http://geoip.nekudo.com/api http://fonts.googleapis.com https://fonts.googleapis.com http://fonts.gstatic.com http://maxcdn.bootstrapcdn.com http://*.tawk.to https://*.tawk.to https://*.imgix.net https://s3.eu-central-1.amazonaws.com https://*.s3-eu-central-1.amazonaws.com https://*.s3.amazonaws.com https://connect.facebook.net https://www.facebook.com http://cdn.quilljs.com http://*.geoplugin.net https://*.geoplugin.net http://*.bootstrapcdn.com https://*.bootstrapcdn.com http://*.jquery.com https://*.jquery.com http://*.fontawesome.com https://*.fontawesome.com http://*.cloudflare.com https://*.cloudflare.com http://*.imgix.net https://*.s3.eu-central-1.amazonaws.com;
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
- • Add Strict-Transport-Security header with max-age of at least 1 year
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
- • Consider adding Permissions-Policy to control browser features
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports