Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.DTLS Certificate Expiry & RecommendationsAction9 days until leaf cert expires — 5 issues to addressFIX
Certificate validity
Recommended actions
- Renew certificate — 9 days remaining
- Extend HSTS max-age to at least 31536000 (1 year) to meet the preload list criteria
- Add includeSubDomains to the HSTS directive
- Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
CIPv6 ReadinessActionNo IPv6 supportREVIEW
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.
Source: Google IPv6 stats
A+DNS Records2 A records, 8 ms lookupPASS
| A | 172.66.129.122, 104.20.10.19 |
| AAAA | — |
| CNAME | — |
| NS | sid.ns.cloudflare.com, anna.ns.cloudflare.com |
| MX | 1 aspmx.l.google.com 3 alt1.aspmx.l.google.com 3 alt2.aspmx.l.google.com 5 aspmx3.googlemail.com 5 aspmx2.googlemail.com |
| TXT | MS=ms91396456 apple-domain-verification=iG3RkP4n8Hzw0pRt mixpanel-domain-verify=6b7a6a92-44ff-49bf-9c8f-5388a15a0a9e google-site-verification=gBdJsCfmxDcnxzLlqVKsh3VlHvhgLLorfcc_xPWVhIE SPF v=spf1 include:_spf.google.com include:spf.mtasv.net include:helpscoutemail.com ... v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyDN/VYJkBKzMEXfL5M... |
| CAA | Lookup not available with standard resolver |
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
A+Redirect ChainNo redirects — direct accessPASS
https://feedly.com
44 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://feedly.com | 200 | 44 ms | HTTP/1.1 | cloudflare |
A+Crawlabilityrobots.txt present, sitemap with 4006 URLsPASS
User-agent: *
Disallow: /k/
Disallow: /i/entry/
Disallow: /e/
Disallow: /f/
Disallow: /a/
Disallow: /b/
Disallow: /t/
Disallow: /d.*/
Disallow: /v3/
Allow: /v3/feeds
Allow: /v3/recommendations
Allow: /v3/mixes/contents
Allow: /v3/streams/contents
Allow: /v3/streams/ids
Allow: /v3/search/feeds
Allow: /v3/topics
Allow: /v3/alerts/preview
Allow: /v3/entities
Allow: /ai/
Allow: /cve/
Allow: /ahead/
Allow: /customers/
Allow: /new-features/
Allow: /resources/
Sitemap: https://feedly.com/sitemap.xml
Sitemap: https://feedly.com/marketing-sitemap.xml
Sitemap: https://feedly.com/ai/sitemap.xml
Sitemap: https://feedly.com/cve/sitemap.xml
A+URL Variantswww/non-www, trailing slash, HTTP→HTTPSPASS
www / non-www
Preferred variant: non-www
HTTP → HTTPS
Consistent
A+Domain Intelligencefeedly.com — via Gandi SAS, 18 years, 2 months old, hosted on CloudflarePASS
1410 days
May 25, 2030
9 days
Issued by DigiCert Inc
18 years, 2 months
Registered May 25, 2008
Enabled
Protects against DNS spoofing
Cloudflare
ASN AS13335
172.66.129.122
Gandi SAS
Expiry timeline
Recommended actions
- Renew the TLS certificate or verify auto-renewal is working
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice