SSL Certificate Analysis for workflowy.com - Security Grade & TLS Configuration

Open Cached · just now

96/100 SECURITY SCORE

Certificate Information

Subject

CN=workflowy.com

Issuer

C=US, O=Let's Encrypt, CN=E8

Valid From

January 06, 2026

Valid Until

April 06, 2026 77 days

Public Key

ECDSA 256 bit (P-256) Adequate

Signature Algorithm

ECDSA-SHA384

SHA-256 Fingerprint

08:51:9C:6F:5C:1E:B8:EA:14:40:CE:C5:0C:2F:2A:50:C4:B4:5C:93:50:D8:BA:FB:6E:EF:BA:9F:4E:F6:E7:72

Alternative Names

2 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Good

object-src; form-action; script-src; +14 more

object-src 'none'; form-action 'self' https://workflowy.com https://beta.workflowy.com; script-src 'self' 'report-sample' https://workflowy.com https://beta.workflowy.com https://js.stripe.com https://*.js.stripe.com https://checkout.stripe.com https://maps.googleapis.com https://www.googletagmanager.com https://*.google-analytics.com 'sha256-AM+qrHgqKjdOAwV4tcH6/4BD1Bwq0hvfFE4XPJgm73A=' https://www.recaptcha.net https://www.gstatic.com https://www.google.com https://ajax.googleapis.com https://d3e54v103j8qbb.cloudfront.net https://*.website-files.com https://static.hotjar.com https://script.hotjar.com https://*.youtube.com https://platform.twitter.com https://cdn.syndication.twimg.com https://*.facebook.net https://www.loom.com https://cdn.loom.com 'nonce-Kq7cui3OkWmrKMQ7TBoSsQ=='; upgrade-insecure-requests; frame-ancestors 'self' https://workflowy.com https://beta.workflowy.com https://workflowy.com https://*.workflowy.com https://teams.microsoft.com; font-src 'self' data: https://workflowy.com https://beta.workflowy.com https://fonts.gstatic.com https://fonts.cdnfonts.com https://cdnjs.cloudflare.com https://*.website-files.com https://use.typekit.net; media-src 'self' blob: https://workflowy.com https://beta.workflowy.com https://s3.amazonaws.com; script-src-elem 'self' 'report-sample' https://workflowy.com https://beta.workflowy.com https://js.stripe.com https://*.js.stripe.com https://checkout.stripe.com https://maps.googleapis.com https://www.googletagmanager.com https://*.google-analytics.com 'sha256-AM+qrHgqKjdOAwV4tcH6/4BD1Bwq0hvfFE4XPJgm73A=' https://www.recaptcha.net https://www.gstatic.com https://www.google.com https://ajax.googleapis.com https://d3e54v103j8qbb.cloudfront.net https://*.website-files.com https://static.hotjar.com https://script.hotjar.com https://*.youtube.com https://platform.twitter.com https://cdn.syndication.twimg.com https://*.facebook.net https://www.loom.com https://cdn.loom.com 'nonce-Kq7cui3OkWmrKMQ7TBoSsQ=='; default-src 'self' https://workflowy.com https://beta.workflowy.com; frame-src 'self' https://workflowy.com https://beta.workflowy.com https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com https://checkout.stripe.com https://www.recaptcha.net https://www.google.com https://*.youtube.com https://youtube.com https://*.youtube-nocookie.com https://platform.twitter.com https://syndication.twitter.com https://x.com https://www.loom.com * workflowy:; base-uri 'self'; worker-src 'self' blob: https://workflowy.com https://beta.workflowy.com; style-src-elem 'self' 'unsafe-inline' 'report-sample' https://workflowy.com https://beta.workflowy.com https://fonts.googleapis.com https://fonts.cdnfonts.com https://cdnjs.cloudflare.com https://*.website-files.com https://use.typekit.net; img-src 'self' data: blob: https://workflowy.com https://beta.workflowy.com https://*.stripe.com https://*.google-analytics.com https://stats.g.doubleclick.net https://www.googletagmanager.com https://*.website-files.com https://uploads-ssl.webflow.com https://s3.amazonaws.com https://*.hotjar.com https://i.ytimg.com https://s.ytimg.com https://yt3.ggpht.com https://pbs.twimg.com https://ton.twimg.com https://x.com https://*.facebook.com https://*.facebook.net https://cdn.loom.com; style-src 'self' 'unsafe-inline' 'report-sample' https://workflowy.com https://beta.workflowy.com https://fonts.googleapis.com https://fonts.cdnfonts.com https://cdnjs.cloudflare.com https://*.website-files.com https://use.typekit.net; connect-src 'self' https://workflowy.com https://beta.workflowy.com https://api.stripe.com https://checkout.stripe.com https://maps.googleapis.com https://*.google-analytics.com https://www.googletagmanager.com https://stats.g.doubleclick.net https://www.recaptcha.net https://www.google.com https://s3.amazonaws.com https://sentry.workflowy.com https://api.amplitude.com https://hotjar.com https://*.hotjar.com https://vars.hotjar.com wss://*.hotjar.com https://*.hotjar.io https://syndication.twitter.com https://*.facebook.com https://www.loom.com https://workflowy.zendesk.com; report-uri /csp-report

X-Frame-Options

Excellent

DENY

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

same-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Strengthen CSP by removing 'unsafe-eval'
• Consider adding Permissions-Policy to control browser features

CAA Records (Certificate Authority Authorization)

CAA Records

Configured (Restricts certificate issuance)

Current Issuer

Authorized (Matches CAA policy)

Authorized CAs

amazon.com amazonaws.com amazontrust.com awstrust.com comodoca.com digicert.com ; cansignhttpexchanges=yes letsencrypt.org pki.goog ; cansignhttpexchanges=yes ssl.com

Wildcard CAs

amazontrust.com awstrust.com comodoca.com digicert.com ; cansignhttpexchanges=yes letsencrypt.org pki.goog ; cansignhttpexchanges=yes ssl.com amazon.com amazonaws.com

Recommendations

• Consider using critical flag (flags=128) for stricter CAA enforcement
• You have authorized 9 CAs - consider limiting to only the CAs you actively use
• Consider adding 'iodef' records to receive notifications about unauthorized certificate issuance attempts

Subject Alternative Names

2 domains

workflowy.com *.workflowy.com