Explore this guidance in context: Website security. Each topic includes an overview, related guides and a working template.

In this article

01A successful connection is one observation

HTTPS uses TLS to protect a connection and authenticate the server’s identity. A successful HTTPS request shows that the particular client connected successfully at that time. It does not provide a complete inventory of supported protocol versions, cipher suites, certificate renewal arrangements or every hostname on the service.

CyberScan’s public baseline should be read according to the observations it actually reports. Unless a test explicitly retrieves and evaluates certificate details, do not interpret an HTTPS response as a certificate-expiry assessment. A failed request may also reflect a network restriction or timeout that needs investigation.

02Check both sides of a CDN

When a content delivery network or reverse proxy sits in front of the website, the public client usually connects to its edge. The proxy makes a separate connection to the origin server. Public observations of the edge do not establish how the origin connection is configured.

Ask the host which component terminates TLS, who renews certificates and how traffic to the origin is protected and validated. Review the actual hostnames in use, including the bare domain, www address and customer-facing subdomains.

03Introduce HSTS with care

HTTP Strict Transport Security tells supporting browsers to use HTTPS for future connections during the policy’s lifetime. The includeSubDomains directive extends that instruction to subdomains. Before extending the policy or considering preload, confirm that every affected service can support HTTPS and that the team understands recovery implications.

04A practical review

  1. Verify the correct hostname and redirect destination, then test key customer journeys over HTTPS.
  2. Confirm certificate ownership, renewal monitoring and the origin configuration with your provider.
  3. Use a dedicated TLS assessment when you need protocol, cipher or certificate-chain detail.
  4. Record which endpoint and connection were tested so later comparisons remain meaningful.

Sources & further reading

NCSC: Using TLS to protect data (opens in a new tab)MDN: Strict-Transport-Security (opens in a new tab)Cloudflare: Full (strict) encryption mode (opens in a new tab)

Use the linked primary sources for current technical details. Guidance reflects the scope and dates described in this article.

TURN READING INTO ACTION

Put the guidance to work.

Choose a check with the right scope, inspect its observations and follow up with the person who can make the change.

Choose a security check More practical resources