SSL Verification Bypassed
The server's SSL certificate could not be verified. The analysis was completed using insecure mode. Data may be less reliable.
Reason:
Expired Certificate - the server's certificate has expired
Open
Cached
·
just now
63/100
SECURITY SCORE
Certificate Information
Subject
CN=xplenty.com
Issuer
C=US, O=Let's Encrypt, CN=R13
Valid From
September 08, 2025
Valid Until
December 07, 2025
Expired
Public Key
RSA
2048 bit
Adequate
Signature Algorithm
SHA256-RSA
SHA-256 Fingerprint
09:9A:C6:80:96:F1:D2:58:53:45:5E:68:41:A1:00:93:C8:7F:9A:FD:78:F3:B2:A9:D2:7B:E8:8D:56:51:A9:9D
Alternative Names
Security Configuration
TLS Protocols
TLS 1.0
TLS 1.1
TLS 1.2
Forward Secrecy
Limited
(Check cipher configuration)
Warnings
- • TLS 1.3 is not supported (recommended)
- • TLS 1.1 is deprecated and should be disabled
- • TLS 1.0 is deprecated and should be disabled
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=31536000
Content-Security-Policy
Basic
script-src; worker-src; frame-src; +4 more
script-src 'unsafe-eval' 'unsafe-inline' 'self' *.openai.com chatgpt.com *.donal-tobin.workers.dev *.immagnify.com www.google.com www.gstatic.com *.upvert.io *.upvertcdn.io *.liadm.com *.usbrowserspeed.com *.getwarmly.com *.datashopper.com *.hubspot.com *.sentry-cdn.com *.cloudflare.com *.googleapis.com *.apollo.io *.redditstatic.com *.gstatic.com *.wistia.com *.termly.io *.unifyintent.com *.calendly.com *.adroll.com *.whattime.co.kr *.amazonaws.com *.referralcandy.com *.doubleclick.net *.clearbitscripts.com *.arcade.software *.clarity.ms *.clearbitjs.com *.capterra.com *.facebook.net *.googletagmanager.com *.hs-scripts.com *.licdn.com *.woopra.com *.ads-twitter.com *.youtube.com *.hotjar.com *.hsforms.net *.hs-analytics.net *.hs-banner.com *.hsadspixel.net *.hscollectedforms.net *.bing.com *.google-analytics.com *.g2crowd.com *.autopilothq.com *.mxpnl.com *.chilipiper.com *.googleadservices.com *.clickcease.com *.intercomcdn.com *.intercom.io *.visualwebsiteoptimizer.com app.vwo.com cdn.pushcrew.com; worker-src 'self' blob:; frame-src www.google.com www.gstatic.com app.vwo.com whattime.co.kr calendly.com *.liadm.com *.adroll.com *.doubleclick.net *.youtube.com *.facebook.com *.hsforms.com *.chilipiper.com *.arcade.software *.googletagmanager.com *.visualwebsiteoptimizer.com; default-src https: wss: data: 'unsafe-inline' ; object-src 'none'; frame-ancestors 'none' ; media-src 'self' blob: https:
X-Frame-Options
Missing
Not configured
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
geolocation=()
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
CAA Records (Certificate Authority Authorization)
CAA Records
Configured
(Restricts certificate issuance)
Current Issuer
Authorized
(Matches CAA policy)
Recommendations
- • Consider using critical flag (flags=128) for stricter CAA enforcement
- • You have authorized 7 CAs - consider limiting to only the CAs you actively use
- • Consider adding 'iodef' records to receive notifications about unauthorized certificate issuance attempts
- • Consider adding 'issuewild' records to control wildcard certificate issuance