DigitalBanzai Knowledge

TLS / HTTPS

Understand how HTTPS protects connections and what certificate verification and HTTP redirects can reveal.

Italian version
Severity
Moderate
Estimated fix time
10-30 min
Technical level
Beginner / Intermediate
Applies to
WordPressStatic SitesCMS / E-commerceHosting / Server Configuration

Quick answer

HTTPS protects the connection between a browser and a site using TLS and a certificate that helps verify the domain's identity. A visitor opening an http:// address may be sent to the HTTPS version. These are separate concerns: a valid certificate does not show that automatic redirection from HTTP works, and a redirect does not show that the certificate is valid.

Why it may matter

If certificate verification fails, a browser may display a warning and interrupt a visit. If an HTTP address does not redirect to HTTPS, someone using an old address may stay on an unprotected connection, depending on configuration and browser behavior. The guide shows Moderate; practical priority depends on the exact error and the path visitors use.

Questions to ask

Should the domain serve pages over HTTPS? Should HTTP addresses still in use lead to the protected version? Does the certificate cover the right domain, and is it managed by your host or another service? These answers help identify who should act.

What TrustyRunner checks

TrustyRunner runs two independent, limited tests: it attempts a verified TLS connection on port 443 and separately checks whether the HTTP version redirects to HTTPS. From the first test it may record the negotiated protocol and certificate expiration. This check does not include the certificate issuer.

How to read the result

  • Certificate verification failed: the verified connection did not succeed. The result alone does not identify the exact cause.
  • Redirect to HTTPS not observed: this is reported as a finding only when the redirect test has a conclusive result.
  • Protocol and expiration: these are observed data. The check does not apply an automatic threshold to the expiration date.

If one test is unavailable, overall verification is partial; if both are unavailable, the result is unavailable and does not prove a security defect.

For a certificate that did not verify, review the domain, certificate, and configuration with your host before assuming a cause. If a redirect is conclusively absent, check the server's HTTP rules or the service delivering the site before changing them. Use the expiration date to plan renewal according to your procedures; it is not an automatic error in this check.

Limits of this check

TrustyRunner does not evaluate the complete TLS setup, cipher suites, compatibility with every browser, or continuous site availability. It does not certify application security or always establish why certificate verification fails.

Verify with a new scan

After a change, a new scan can repeat both tests and compare the outcomes. Even a positive result describes those tests, not the site's entire HTTPS security.