Website check
facebook.com
In plain English
The site scores a B (77/100), with no severe problems. The most urgent item is the HTTPS certificate, which the check says expires in 7 days, and after that browsers will warn visitors. Confirm that renewal is in place. The other findings are lower-risk clean-up items, so visitors don't need to be worried by them.
Old TLS versions still accepted
The server still accepts TLS 1.1, outdated encryption that browsers dropped in 2020 and that weakens protection for older devices.
How to fix: Turn off TLS 1.0 and 1.1 in the server or CDN settings and keep TLS 1.2 and 1.3.
TLSv1.1 with ECDHE-ECDSA-AES128-SHA
HTTPS certificate expires soon
The certificate expires in 7 days. After that, browsers show a security warning.
How to fix: Renew it now and make sure automatic renewal works.
valid until 2026-10-29
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: fr, sb
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up facebook.com and connecting over HTTPS
- 03Connected over HTTPS: www.facebook.com answered 200 after 2 redirects
- 04Certificate from DigiCert Inc, valid 7 more days (TLSv1.3)
- 05Read the security headers: HSTS, CSP, X-Frame-Options, nosniff set; missing Referrer-Policy
- 06Checked 2 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: still accepted
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 77/100, grade B. Writing it up in plain English
Technical details (28)
- ip
- 57.144.216.1
- caa
- 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
- tls cipher
- TLS_CHACHA20_POLY1305_SHA256
- tls issuer
- DigiCert Inc
- tls subject
- *.facebook.com
- tls validTo
- 2026-10-29T23:59:59.000Z
- tls daysLeft
- 7
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 redirect=_spf.facebook.com
- email apex
- facebook.com
- email dmarc
- v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100
- status
- 200
- cookies
- fr, sb
- headers x-frame-options
- DENY
- headers permissions-policy
- accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-bOHZNMWw' blob: 'self' connect.facebook.net 'unsafe-eval' https://accounts.google.com https://*.google-analytic...
- headers strict-transport-security
- max-age=15552000; preload
- finalUrl
- https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2F
- requests
- 5
- timingMs
- 470
- reachable
- true
- oldTlsProbe
- accepted
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.