Skip to content

21 – HTTP & Network

The test audits how the website is delivered: which protocols and encryption versions the server supports, and which security headers it sends.

This test takes a while

To establish what the server supports, the test opens separate connections and tries each TLS and HTTP version in turn, over both IPv4 and IPv6. That makes it one of the slower tests. If you just want to try the tool out, start with 22 – Energy Efficiency.

What is tested?

Protocols

  • HTTPS: that the site is available over an encrypted connection
  • HTTP/1.1, HTTP/2 and HTTP/3: support for the newer versions, which are noticeably faster on mobile networks
  • IPv4 and IPv6: that the site is reachable over both

Encryption

  • TLS 1.3 and TLS 1.2: support for the current versions
  • TLS 1.1 and TLS 1.0: these count as insecure, and supporting them lowers the score

Headers

Security headers such as HSTS and Content Security Policy are audited, including how strictly the policy is written.

How it affects the score

Each check adds or subtracts. Lacking IPv6 or HTTP/2 lowers the score; still allowing TLS 1.0 lowers it more, because that's an active problem rather than a missing improvement.

Running the test 

python default.py -u https://example.com -t 21 -r

Content Security Policy only:

python default.py -u https://example.com -t 21 -r \
  --setting tests.http.csp-only=true

Settings

Setting Default Meaning
tests.http.csp-only false Audit only the Content Security Policy

See also