Skip to content
https://headroommedia.nl

Infrastructure

· 17 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
89
GRADE
B
FIX
1
REVIEW
7
PASS
8
INFO
1
Probed from Madrid, Spain
200 OK
Checks
17
8 PASS 7 REVIEW 1 FIX
D
URL Variants
Action
www/non-www, trailing slash, HTTP→HTTPS
FIX
www/non-www, trailing slash, HTTP→HTTPS
Critical::
Both www and non-www versions serve content
Got: Both variants return 200 Expected: One variant 301-redirects to the other
Critical::
HTTP version does not redirect to HTTPS
Got: HTTP 200 Expected: 301 redirect to HTTPS

www / non-www

200https://www.headroommedia.nl/
200https://headroommedia.nl/

Inconsistent — duplicate content risk

HTTP → HTTPS

200http://headroommedia.nl/

HTTP version does not redirect to HTTPS

B
CAA Records
No CAA records (any CA may issue certificates)
REVIEW
No CAA records (any CA may issue certificates)
Info::
No CAA records published
Without CAA records, any publicly-trusted CA can issue certificates for this domain. Adding a CAA record (`yourdomain. IN CAA 0 issue "letsencrypt.org"`) restricts issuance to CAs you authorize. Required by CAB Forum baseline since 2017; the default of 'any CA' is widely supported but is the broader attack surface for issuance fraud.
B
Reverse DNS
0/2 IPs match cert SAN
REVIEW
0/2 IPs match cert SAN
Info::
PTR for 46.30.215.48 does not match any cert SAN: webcluster2.webpod15-cph3.one.com
Common when behind a CDN or shared hosting (PTR points at the provider's hostname). Mismatch can also affect mail deliverability if this IP sends email -- many MTAs reject mail when forward+reverse DNS disagree.
Info::
PTR lookup failed for 2a02:2350:5:10e:8082:36d7:e1b9:8696: lookup 2a02:2350:5:10e:8082:36d7:e1b9:8696: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
C
HTTP Probe Timing
Action
Total 1858 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
REVIEW
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
46 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
44 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
54 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
1.81 s
Total Time Total request time from DNS lookup through full response.
1.86 s

Connection waterfall

DNS Lookup 46 ms TCP Connect 44 ms TLS Handshake 54 ms Server Processing 1.67 s Content Transfer 44 ms
B
TLS Certificate Expiry & Recommendations
70 days until leaf cert expires — 3 issues to address
REVIEW

Certificate validity

70
days left
0d 30d 60d 90d+

Recommended actions

  • Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
B
CDN & Delivery
Varnish
REVIEW
Varnish
Info::
Document is served via Varnish CDN
Got: via: 1.1 webcache2 (Varnish/trunk)
Document served via CDN: Varnish
Provider Varnish Evidence via: 1.1 webcache2 (Varnish/trunk)
B
Operational Status Page
No status page link detected
REVIEW
No status page link detected
Info::
No operational status page link detected
Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.
B
Health Check Endpoint
No conventional health endpoint found
REVIEW
No conventional health endpoint found
Info::
No conventional health endpoint found
Health endpoints (/health, /healthz, /status, /ping, /api/health) let uptime monitors, load balancers, and orchestration systems (Kubernetes, ECS, Fly.io) verify the service is alive. Marketing sites and small services often skip them legitimately; flagged as Info, not a failure. Probe results: /api/health: 429, /health: 429, /healthz: 429, /ping: 429, /status: 429.
A
DNS Records
1 A records, 46 ms lookup
PASS
1 A records, 46 ms lookup
Info::
Resolves to 1 IPv4 address(es)
Got: 46.30.215.48
Info::
Single A record — no DNS redundancy
Multiple A records provide failover if one server goes down.
Info::
Has 1 IPv6 (AAAA) record(s)
Got: 2a02:2350:5:10e:8082:36d7:e1b9:8696
Info::
2 nameserver(s) configured
Got: ns01.one.com, ns02.one.com
Info::
4 mail exchanger(s) configured
Info::
No SPF record found in TXT records
SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.
Info::
DNS resolution time: 46 ms
Got: 46 ms
A46.30.215.48
AAAA2a02:2350:5:10e:8082:36d7:e1b9:8696
CNAME—
NSns01.one.com, ns02.one.com
MX
10 mx2.pub.mailpod12-cph3.one.com
10 mx3.pub.mailpod12-cph3.one.com
10 mx4.pub.mailpod12-cph3.one.com
10 mx1.pub.mailpod12-cph3.one.com
TXT
google-site-verification=I-FATKyjgR4C1p0TByLJjbUheLQYyPP-N-SLSS0Z0sk
CAALookup not available with standard resolver
Resolved in 46 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more ▾

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.

Why this matters

Without SPF, receiving servers can't validate sending IPs — your domain is easier to spoof in phishing.

Learn more ▾

SPF complements DMARC. Both should be published. SPF records list authorized sending IPs (e.g., `v=spf1 include:_spf.google.com ~all` for Google Workspace). After publishing, verify in Google Postmaster Tools or mxtoolbox.

Source: RFC 7208 (SPF)

A+
Subdomain Takeover
No subdomain takeover risk detected
PASS
No subdomain takeover risk detected
Info::
No CNAME record present
A+
DNSSEC
Signed and validating
PASS
Signed and validating
Info::
DNSSEC fully signed and chain validates (ECDSAP256SHA256)
A+
Multi-Resolver DNS Speed
Mean 42ms across 3 resolvers (spread 29ms)
PASS
Mean 42ms across 3 resolvers (spread 29ms)
Info::
Cloudflare: 24ms
Got: 24ms via 1.1.1.1:53
Info::
Google: 51ms
Got: 51ms via 8.8.8.8:53
Info::
Quad9: 53ms
Got: 53ms via 9.9.9.9:53
A+
Redirect Chain
No redirects — direct access
PASS
No redirects — direct access
Info::
No redirects — direct access
Got: https://headroommedia.nl

https://headroommedia.nl

263 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://headroommedia.nl200263 msHTTP/1.1Apache
A+
IPv6 Readiness
IPv6 reachable (37 ms)
PASS
IPv6 reachable (37 ms)
Info::
IPv6 is configured and reachable at 2a02:2350:5:10e:8082:36d7:e1b9:8696
Got: 37 ms connect
IPv6 Ready
AAAA Records 2a02:2350:5:10e:8082:36d7:e1b9:8696 Connection Reachable (37 ms)
A+
Crawlability
robots.txt present, sitemap with 25 URLs
PASS
robots.txt present, sitemap with 25 URLs
Info::
robots.txt is present
Got: 890 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 25 entries
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 890 B Sitemaps referenced 1 User-agents * Blocking No — crawling allowed
# If the Joomla site is installed within a folder such as at
# e.g. www.example.com/joomla/ the robots.txt file MUST be
# moved to the site root at e.g. www.example.com/robots.txt
# AND the joomla folder name MUST be prefixed to the disallowed
# path, e.g. the Disallow rule for the /administrator/ folder
# MUST be changed to read Disallow: /joomla/administrator/
#
# For more information about the robots.txt standard, see:
# http://www.robotstxt.org/orig.html
#
# For syntax checking, see:
# http://tool.motoricerca.info/robots-checker.phtml
Sitemap: https://www.yourwebsite.com/sitemap.xml
User-agent: *
Disallow: /administrator/
Disallow: /bin/
Disallow: /cache/
Disallow: /cli/
Disallow: /components/
Disallow: /includes/
Disallow: /installation/
Disallow: /language/
Disallow: /layouts/
Disallow: /libraries/
Disallow: /logs/
Disallow: /modules/
Disallow: /plugins/
Disallow: /tmp/
sitemap.xml 200 OK
Type URL Set URLs 25 entries Valid XML Yes
Sample URLs:
A+
CDN Cache Observability
Cache state: fresh (Age=0)
PASS
Cache state: fresh (Age=0)
Info::
CDN cache state observable via 1 header(s)
Got: age=0
Domain Intelligence
Domain intelligence data not available
INFO
Domain intelligence data not available

RDAP and WHOIS lookup both failed

All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback