The site audits itself — live, on every visit. Some checks run in your browser, some on the server. Nothing secret here: anyone can see all of this in the server's responses.
audit.sh
# Browser — checked on your side right now
[ .. ]HTTPS# The connection is encrypted: nobody on the way (ISP, public Wi-Fi) can read or tamper with the page.
[ .. ]HTTP/2+# A modern protocol: faster and free of HTTP/1.1's old problems.
[ .. ]HSTS# The browser remembers that the site is HTTPS-only and won't let anyone downgrade the connection to HTTP.
[ .. ]CSP# Content-Security-Policy allows scripts only from this site and only with a one-time nonce — an injected script (XSS) won't run.
[ .. ]Clickjacking# The site can't be embedded in someone else's page to trick you into clicking something.
[ .. ]nosniff# The browser won't guess file types — an uploaded image can't be passed off as a script.
[ .. ]Referrer-Policy# When you follow an external link, only the domain is sent, not the page address.
[ .. ]Permissions-Policy# Camera, microphone and geolocation are disabled for the whole page.
[ .. ]Software version# The server doesn't reveal what software and version it runs — fewer hints for an attacker.
[ .. ]Third-party requests# Everything loads from this site only: no CDNs, Google Fonts, analytics or trackers.
[ .. ]Cookie# Cookies visible to the page. No tracking ones — only your language choice, if you changed it.
# Server — checked every 6 hours
[ .. ]TLS# Encryption protocol version: TLS 1.3 is the newest and most robust.
[ .. ]Certificate# Who issued it and how long it's valid. Let's Encrypt renews automatically.
[ .. ]HTTP → HTTPS# If you type the address without https://, the server immediately redirects to the secure version.
[ .. ]HSTS preload# The domain is on a list built into browsers: HTTPS from the very first visit, before the server even answers.
[ .. ]CAA# A DNS record that allows only the listed authorities to issue certificates for the domain.
[ .. ]DNSSEC# Signed DNS answers. Not enabled: HTTPS and HSTS preload protect the site from DNS spoofing.
[ .. ]security.txt# The standard file (RFC 9116) with contacts for reporting vulnerabilities.
Check for yourself
No need to take this page's word for it — independent services run the same checks: