Best practices

Page is served over valid HTTPS

Medium impact · weight 6 · worth up to 1.6 points of the total score

Why it matters

Browsers mark plain http pages as not secure, and an expired certificate replaces the whole page with a warning that almost nobody clicks through. Certificates now last 90 days or less, so a renewal that silently stopped working takes a site down within weeks. Protocols older than TLS 1.2 are refused by current browsers.

How to fix it

Serve the page over HTTPS with automatic renewal (Let's Encrypt through certbot, or a CDN that manages the certificate), and check the renewal job actually runs. Disable TLS 1.0 and 1.1 in the server or CDN settings.

Check a page for this, and the other 70 checks at once

More Best practices checks

Character encoding is declared

With no declared charset the browser guesses, and the guess is wrong often enough that accented characters, quotes, and emoji turn into mojibake for some visitors and not others.

Lighthouse best practices score

Lighthouse's best practices audit covers what makes a page trustworthy to a browser: HTTPS everywhere, no deprecated APIs, no errors in the console, images shown at their real aspect ratio, a valid doctype and charset.

Page uses the HTML5 doctype

A missing or legacy doctype drops the browser into quirks mode, where box sizing and layout follow rules from the 1990s. The page then differs from every modern stylesheet assumption.

Response sends the standard security headers

A handful of response headers switch on protections the browser already has: HSTS keeps visitors on HTTPS, a Content-Security-Policy limits where scripts may come from, nosniff stops files being run as the wrong type, frame protection stops the page being embedded to trick clicks, and Referrer-Policy and Permissions-Policy limit what leaks and what the page may ask for. Security scanners and clients' IT teams grade sites on exactly this list.

See all checks