Performance · 15 points
HTTPS
One check, stated three ways: what we measure, what would make it wrong, and how to confirm it yourself.
What this measures
Whether the audited URL ends up on an https: connection.
Where this check can be wrong
We report the final URL after redirects. If your host answers https but a CDN rule sends some paths back to http, only the path we took is visible here.
Verify it without taking our word for it
curl -sI http://your.site | grep -i location, then curl -sI https://your.site and confirm the certificate chain loads without a warning in a browser.