Website check
google.com
In plain English
The site scores a C (60/100). The check found several gaps in how it protects visitor connections and browser settings, but it does not show that anyone has broken in. The most important fix is to make every connection use HTTPS: redirect plain http:// visits to HTTPS, add an HSTS header so browsers stick to it, and turn off the old TLS 1.1 setting. Visitors do not need to panic, but they are more exposed than they should be on hostile networks until these gaps are closed.
Old TLS versions still accepted
The server still accepts TLS 1.1, outdated encryption that browsers dropped in 2020 and that weakens protection for older devices.
How to fix: Turn off TLS 1.0 and 1.1 in the server or CDN settings and keep TLS 1.2 and 1.3.
TLSv1.1 with ECDHE-ECDSA-AES128-SHA
HTTP does not redirect to HTTPS
Visitors who type the address or follow an old http:// link stay on the unencrypted version of the site.
How to fix: Redirect every http:// request to the same https:// address with a 301.
http://www.google.com/ returned 200
No HSTS header
Without HSTS, a visitor's first connection can be quietly downgraded to plain HTTP on hostile Wi-Fi, exposing what they send.
How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response.
No Content Security Policy
The site only has a report-only policy, which watches for injected scripts but does not block them.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
report-only: object-src 'none';base-uri 'self';script-src 'nonce-ycx5tkYVYXJnU7tEJcuKxw' 'strict-dynamic' 'report...
Cookies sent without the Secure flag
These cookies can travel over plain HTTP, where anyone on the same network can read them.
How to fix: Add the Secure attribute to every cookie the site sets.
Cookies: NID
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: NID
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up google.com and connecting over HTTPS
- 03Connected over HTTPS: www.google.com answered 200 after 1 redirect
- 04Certificate from Google Trust Services, valid 60 more days (TLSv1.3)
- 05Read the security headers: X-Frame-Options set; missing HSTS, CSP, nosniff, Referrer-Policy
- 06Checked 3 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Old TLS 1.0/1.1: still accepted
- 10security.txt found
- 11Plain http:// does not redirect to HTTPS
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 60/100, grade C. Writing it up in plain English
Technical details (25)
- ip
- 142.251.153.119
- caa
- 0 issue "pki.goog"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- www.google.com
- tls validTo
- 2026-12-21T18:41:20.000Z
- tls daysLeft
- 60
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_spf.google.com ~all
- email apex
- google.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
- status
- 200
- cookies
- __Secure-STRP, AEC, NID
- headers server
- gws
- headers x-frame-options
- SAMEORIGIN
- finalUrl
- https://www.google.com/
- requests
- 5
- timingMs
- 292
- reachable
- true
- oldTlsProbe
- accepted
- securityTxt
- true
- httpRedirect
- answers over http (status 200)
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.