Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.BCrawlabilityrobots.txt present, sitemap with 0 URLsREVIEW
Search engines may not be able to parse the sitemap. Fix XML validation errors.
An unparseable sitemap is silently ignored by Google — the URLs it advertises are never queued for crawl.
Learn more ▾ ▴
Google's sitemap parser is strict about XML validity. A single unescaped `&` or unclosed tag invalidates the whole file. Run your sitemap through a validator (Search Console's Sitemaps report flags it) and fix the offending entry. Most generators escape correctly; mistakes usually come from manually-written entries.
Source: sitemaps.org / Google Search Central
An empty sitemap provides no value. Add <url> entries for your pages.
An empty sitemap signals 'no content to index' to Google — actively harmful versus having no sitemap at all.
Learn more ▾ ▴
Google compares URLs in the sitemap against URLs it has crawled. An empty sitemap on a site with thousands of pages signals abandonment. Either populate it correctly (most CMSes auto-generate) or delete the file and let Google crawl normally.
Source: Google Search Central / sitemaps.org
Sitemap: https://www.fbi.gov/sitemap.xml.gz
# Define access-restrictions for robots/spiders
# http://www.robotstxt.org/wc/norobots.html
# By default we allow robots to access all areas of our site
# already accessible to anonymous users
User-agent: *
Disallow:
# Add Googlebot-specific syntax extension to exclude forms
# that are repeated for each piece of content in the site
# the wildcard is only supported by Googlebot
# http://www.google.com/support/webmasters/bin/answer.py?answer=40367&ctx=sibling
User-Agent: Googlebot
User-Agent: Bingbot
User-Agent: Slurp
User-Agent: DuckDuckBot
Disallow: /@@search?
Disallow: /search?
Disallow: /*atct_album_view$
Disallow: /*folder_factories$
Disallow: /*folder_summary_view$
Disallow: /*login_form$
Disallow: /*mail_password_form$
Disallow: /*search_rss$
Disallow: /*sendto_form$
Disallow: /*summary_view$
Disallow: /*thumbnail_view$
Disallow: /plonejsi18n$
Disallow: /*@@castle.cms.querylisting*?
Disallow: /*interactive*
BURL Variantswww/non-www, trailing slash, HTTP→HTTPSREVIEW
www / non-www
Inconsistent — duplicate content risk
HTTP → HTTPS
Consistent
CTLS Certificate Expiry & RecommendationsAction26 days until leaf cert expires — 3 issues to addressREVIEW
Certificate validity
Recommended actions
- Renew certificate — 26 days remaining
- Submit your domain to hstspreload.org to be added to the Chrome preload list
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
BCDN & DeliveryCloudflareREVIEW
A+DNS Records2 A records, 22 ms lookupPASS
| A | 104.16.148.244, 104.16.149.244 |
| AAAA | 2606:4700::6810:94f4, 2606:4700::6810:95f4 |
| CNAME | — |
| NS | ns-cloud-e1.googledomains.com, ns-cloud-e2.googledomains.com, ns-cloud-e3.googledomains.com, ns-cloud-e4.googledomains.com |
| MX | 10 mx-east.fbi.gov 20 mx-west.fbi.gov |
| TXT | MS=ms39271050 625558384-8740534 SPF v=spf1 +mx ip4:153.31.0.0/16 -all apple-domain-verification=oOspXl6Jvnx9HzLM amazonses: iUbfpGEqhMPlcmJ0aykJZREltK6pWio9wOgRngnJOQE= fastly-domain-delegation-weownfbi.gov-273985-2020-08-06 google-site-verification=6UEk-jfg1xPNjz_rQGcRFJOBGxMy1aARDZUTXgSNAqw google-site-verification=L8cauHJF4MANoTCkMbrLkAVfHBta28ctva9n1IDekTo google-site-verification=uTH4Vg-Xcc9hTqSdeThbT9UnYvuphObtVSpCEgaGr78 _globalsign-domain-verification=xZMJnzdDAgURaBjUZ6qbqWaaYmV5W3sfo3TF8mUxne 8OOn7pVOB40yx/xtV+rLeDEYiUCieNfF7XI2xMbcm8t8PfUvZsCwGxmvHu2DLsMUkZ6UTYUvIJ49EPi3... ublrZj1CzpSEiwtiRFKDAyiek8hRqkqaTTApxvhwai14i8JqVBOauW4cA06i39H5Lhl3HnALCM/xfTxI... adobe-idp-site-verification=101945e35b37c6efd526cf706f04bc9545a02f9cdc58dbf71867... |
| CAA | Lookup not available with standard resolver |
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
ARedirect Chain1 redirect(s), 263 ms totalPASS
https://fbi.gov
37 ms · HTTP/1.1
https://www.fbi.gov/
227 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://fbi.gov | 301 | 37 ms | HTTP/1.1 | cloudflare |
| 2 | https://www.fbi.gov/ | 200 | 227 ms | HTTP/1.1 | cloudflare |
See the visual redirect chain in the HTTP Probe tab →
A+IPv6 ReadinessIPv6 reachable (1 ms)PASS
A+Domain Intelligencefbi.gov — via get.gov, 28 years, 11 months oldPASS
40 days
August 21, 2026
26 days
Issued by Google Trust Services
28 years, 11 months
Registered October 2, 1997
Enabled
Protects against DNS spoofing
Unknown
2606:4700::6810:94f4
get.gov
Expiry timeline
Recommended actions
- Renew the domain or enable auto-renewal to prevent accidental expiry
- Renew the TLS certificate or verify auto-renewal is working
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice