HTTPS, SSL & Security Report for mngm.com

HTTP to HTTPS redirect

HTTP port 80 is not responding, so there is no HTTP listener to redirect. Modern browsers upgrade to HTTPS automatically.

Note: Port 80 may be firewalled or intentionally closed. Opening it with a 301 to HTTPS ensures visitors who type http:// are redirected rather than getting a connection error.

Security headers2/6

• HSTS
• CSP
• X-Frame-Options — sent, but weakSent as "SAMEORIGIN, SAMEORIGIN", which browsers ignore. Use DENY or SAMEORIGIN (or a CSP frame-ancestors directive).
• X-Content-Type-Options
• Referrer-Policy — sent, but weakSent as "no-referrer-when-downgrade", which sends the full URL — path and query — to other sites. Browsers already default to strict-origin-when-cross-origin when no header is set — use that or no-referrer.
• Permissions-Policy

Score: 2 of 6 headers effective. For the grade factor (5 pts), 4+ headers and Content-Security-Policy (CSP) are both required. We count a header only when its value actually provides the protection, so a header sent with a weak value counts as “sent, but weak” rather than present. Scanners that count a header as present regardless of its value will report a higher number here.

HSTS (HTTP Strict Transport Security)Enabled

• EnabledYes
• Max-Age365 days
• PreloadNo
• On HSTS preload listNo

Why it matters: HSTS tells browsers to use only HTTPS for this site. Preload allows inclusion in browsers’ built-in HSTS lists.

We check Chromium’s built-in list. hstspreload.org checks eligibility for submission (HSTS header, redirect chain). Results may differ for domains that are preloaded but no longer meet current eligibility rules.