SSL & TLS
Check your website's HTTPS, SSL certificate and TLS configuration for common security issues.
HTTPS protects information transmitted between a visitor's browser and your website. However, seeing a padlock in the browser does not necessarily mean that every part of the HTTPS configuration follows current security practices.
WebInspect examines externally visible SSL/TLS information to help identify certificate and protocol configuration issues.
The WebInspect security inspection can evaluate several aspects of your website's HTTPS configuration, including:
These checks provide a useful overview of the encryption configuration presented by your public website.
Without HTTPS, information transmitted between a browser and a website can potentially be observed or modified by systems positioned between them.
HTTPS uses TLS to provide encryption, integrity and authentication for the connection.
This is particularly important for websites handling login credentials, customer information, forms, account information or payment-related interactions, but HTTPS is considered standard practice for modern websites generally.
An SSL/TLS certificate helps a browser verify that it is communicating with the intended website.
Certificates are issued for limited periods and must be renewed.
An expired certificate can cause browsers to display security warnings to visitors and may prevent applications or integrations from connecting normally.
WebInspect checks certificate information exposed by the website so that certificate problems can be identified before they are overlooked.
TLS has evolved considerably over time.
Older SSL and TLS protocol versions are no longer considered appropriate for modern secure communications. Supporting obsolete protocols can unnecessarily increase the attack surface and may conflict with security or compliance requirements.
WebInspect checks which relevant TLS protocol versions are accepted by the server and highlights outdated protocol support where detected.
Supporting HTTPS is only part of the configuration.
If a website remains accessible over ordinary HTTP without correctly redirecting visitors to HTTPS, users may still initiate an unencrypted connection.
WebInspect follows the website's response and redirect behavior to help identify whether visitors are being directed toward the secure version of the site.
Strict Transport Security provides another layer of HTTPS protection.
When HSTS is configured, browsers can be instructed to access the domain using HTTPS for a defined period rather than attempting ordinary HTTP first.
HSTS needs to be configured carefully, particularly when subdomains are included, because the policy affects how browsers subsequently access the domain.
No single SSL or TLS test can establish that an entire website is secure.
TLS protects communication between systems. It does not determine whether the application itself contains vulnerabilities, whether authentication is implemented correctly or whether the underlying server is secure.
For this reason, WebInspect combines SSL/TLS checks with other externally observable security checks to provide a broader security snapshot.
Run a WebInspect security inspection to review HTTPS, certificate information, TLS protocol support and other externally visible security controls.