Open
Cached
·
just now
92/100
SECURITY SCORE
Certificate Information
Subject
CN=trust.usertesting.com
Issuer
C=US, O=Let's Encrypt, CN=E7
Valid From
November 26, 2025
Valid Until
February 24, 2026
37 days
Public Key
ECDSA
256 bit
(P-256)
Adequate
Signature Algorithm
ECDSA-SHA384
SHA-256 Fingerprint
21:F0:6E:6A:60:CF:9C:82:79:33:6D:09:A5:2D:64:94:A3:09:C1:17:B2:DF:E5:FD:0E:55:85:29:D6:20:F8:45
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
TLS 1.3
Forward Secrecy
Supported
(Modern clients use PFS)
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=31536000; includeSubDomains
Content-Security-Policy
Good
connect-src; img-src; script-src; +16 more
connect-src 'self' https://app.safebase.io https://cdn.safebase.io *.google-analytics.com *.analytics.google.com analytics.google.com adservice.google.com www.google.com stats.g.doubleclick.net api-js.mixpanel.com *.ingest.sentry.io storage.googleapis.com api.segment.io cdn.segment.com *.safebase.io *.chameleon.io *.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io wss://*.intercom-messenger.com https://*.intercom-messenger.com uploads.intercomcdn.com uploads.intercomusercontent.com *.vitally.io api.cr-relay.com *.split.io *.explo.co api.statsig.com autocomplete.clearbit.com api.us.flatfile.io wss://api.us.flatfile.io platform.flatfile.com api.x.flatfile.com *.fullstory.com www.loom.com *.hubspot.com *.hsforms.com *.hsforms.net *.hscollectedforms.net *.hubapi.com js.hs-banner.com js.hs-scripts.com js.hsleadflows.net js.hubspotfeedback.com js.hsadspixel.net www.facebook.com/tr/ cdn.cookielaw.org *.onetrust.com cookies-data.onetrust.io www.paypal.com *.cookiebot.com *.stigg.io api.liveblocks.io wss://api.liveblocks.io *.transcend.io transcend-cdn.com;img-src 'self' blob: data: https://app.safebase.io https://cdn.safebase.io *.safebase.io s.gravatar.com *.googleusercontent.com *.wp.com cdn.auth0.com storage.googleapis.com/public.safebase.co/ www.google.com *.google-analytics.com www.googletagmanager.com www.gstatic.com www.google.ca www.google.ie stats.g.doubleclick.net analytics.google.com px.ads.linkedin.com px4.ads.linkedin.com p.adsymptotic.com *.intercomcdn.com static.intercomassets.com uploads.intercomusercontent.com messenger-apps.intercom.io *.intercom-attachments-1.com *.intercom-attachments-2.com *.intercom-attachments-3.com *.intercom-attachments-4.com *.intercom-attachments-5.com *.intercom-attachments-6.com *.intercom-attachments-7.com *.intercom-attachments-8.com *.intercom-attachments-9.com logo.clearbit.com *.chameleon.io cdn.brandfetch.io *.dratacdn.com platform.securityscorecard.io rs.fullstory.com app.livestorm.co *.hsforms.com *.hsforms.net hubspot.com *.hubspot.com www.facebook.com/tr/ www.facebook.com/privacy_sandbox/pixel/register/trigger/ cdn.cookielaw.org *.onetrust.com *.cookiebot.com;script-src 'self' 'report-sample' 'nonce-KfuHuZjSZVibstD1ZeliZA==' 'strict-dynamic' https://cdn.safebase.io *.safebase.io cdn.mxpnl.com *.google-analytics.com www.gstatic.com www.google.com www.googletagmanager.com cdn.cr-relay.com *.dropbox.com *.dropboxstatic.com embed.explo.co *.chameleon.io *.intercom.io js.intercomcdn.com cdn.vitally.io *.fullstory.com js.hs-analytics.net js.hs-banner.com *.hs-scripts.com static.hsappstatic.net js.hscollectedforms.net *.usemessages.com forms.hsforms.com js.hs-scripts.com js.hsleadflows.net js.hubspotfeedback.com js.hsadspixel.net *.hscollectedforms.net app.svix.com connect.facebook.net cdn.cookielaw.org;manifest-src 'self' https://cdn.safebase.io;media-src *.safebase.io js.intercomcdn.com;default-src 'self' https://cdn.safebase.io;child-src 'self' blob: *.safebase.io intercom-sheets.com www.intercom-reporting.com www.youtube.com player.vimeo.com fast.wistia.net;base-uri 'self';block-all-mixed-content;font-src 'self' https: data: https://cdn.safebase.io *.safebase.io *.intercomcdn.com use.typekit.net fonts.googleapis.com fonts.gstatic.com;form-action 'self' intercom.help *.intercom.io *.statuspage.io calendly.com www.facebook.com/tr/;frame-ancestors 'none';frame-src *.safebase.io *.dropbox.com *.flatfile.io *.flatfile.com intercom-sheets.com www.intercom-reporting.com www.youtube.com player.vimeo.com fast.wistia.net www.loom.com www.google.com *.chameleon.io embedded.tray.io *.hubspot.com app.svix.com www.facebook.com *.cookiebot.com www.googletagmanager.com js.stripe.com portal.productboard.com;object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' use.typekit.net p.typekit.net;upgrade-insecure-requests;worker-src 'self' blob: https://cdn.safebase.io *.safebase.io intercom-sheets.com www.intercom-reporting.com www.youtube.com player.vimeo.com fast.wistia.net;report-uri https://o410058.ingest.sentry.io/api/5283673/security/?sentry_key=3fbff9fa2e9e4c6991906aa26710df82&sentry_release=7ead5aa79499882822b790c8cf898921c97cfd4a&sentry_environment=production
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Present
no-referrer,strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Strengthen CSP by removing 'unsafe-eval'
- • Consider adding Permissions-Policy to control browser features
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports