Skip to content
https://sierraclub.org

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
87
GRADE
B
FIX
0
REVIEW
4
PASS
5
INFO
0
Probed from Madrid, Spain
301 Moved Permanently
Checks
9
5 PASS 4 REVIEW
C
IPv6 Readiness
Action
No IPv6 support
REVIEW
No IPv6 support
Info::
No IPv6 (AAAA) records found
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No IPv6 Support
About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
REVIEW
www/non-www, trailing slash, HTTP→HTTPS
Critical::
Both www and non-www versions serve content
Got: Both variants return 200 Expected: One variant 301-redirects to the other
Info::
HTTP correctly 301-redirects to HTTPS

www / non-www

200https://www.sierraclub.org/
200https://sierraclub.org/

Inconsistent — duplicate content risk

HTTP → HTTPS

301http://sierraclub.org/ https://sierraclub.org/

Consistent

B
TLS Certificate Expiry & Recommendations
172 days until leaf cert expires — 3 issues to address
REVIEW

Certificate validity

172
days left
0d 30d 60d 90d+

Recommended actions

  • Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
B
CDN & Delivery
Incapsula
REVIEW
Incapsula
Info::
Site is served via Incapsula CDN
Got: x-iinfo: 53-35899931-35899968 NNNN CT(14 23 0) RT(1776888909070 96) q(0 0 0 1) r(1 1) U11
CDN Detected: Incapsula
Provider Incapsula Evidence x-iinfo: 53-35899931-35899968 NNNN CT(14 23 0) RT(1776888909070 96) q(0 0 0 1) r(1 1) U11
A+
DNS Records
3 A records, 82 ms lookup
PASS
3 A records, 82 ms lookup
Info::
Resolves to 3 IPv4 address(es)
Got: 199.83.131.200, 199.83.133.200, 199.83.134.200
Info::
No IPv6 (AAAA) records
Info::
5 nameserver(s) configured
Got: ns1.dnsmadeeasy.com, ns0.dnsmadeeasy.com, ns4.dnsmadeeasy.com, ns3.dnsmadeeasy.com, ns2.dnsmadeeasy.com
Info::
5 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 82 ms
Got: 82 ms
A199.83.131.200, 199.83.133.200, 199.83.134.200
AAAA
CNAME
NSns1.dnsmadeeasy.com, ns0.dnsmadeeasy.com, ns4.dnsmadeeasy.com, ns3.dnsmadeeasy.com, ns2.dnsmadeeasy.com
MX
10 aspmx.l.google.com
50 alt2.aspmx.l.google.com
50 alt1.aspmx.l.google.com
100 alt4.aspmx.l.google.com
100 alt3.aspmx.l.google.com
TXT
globalsign-domain-verification=6D904030DED169AF1097C90FD91F8893
globalsign-domain-verification=186c27a11733f8701e56a8ff834ff419
982gl.x.incapdns.net
globalsign-domain-verification=8FD9F6C2739A2202373E780DD68C9DB7
globalsign-domain-verification=40FC5B9372CD131A0B579E91633105DF
facebook-domain-verification=q469pp5uo8p9bhs7whc8i3xrrxe9yb
globalsign-domain-verification=7A1E6B106E306B6D4BE38659D115C66A
apple-domain-verification=loQqMyydRX6GcsTz
globalsign-domain-verification=FCF0FFE9248E5FB050EE4559A28A7873
globalsign-domain-verification=5e2ff394df8f2f33e431a33699610712
atlassian-sending-domain-verification=b8d03f39-cbee-42ce-a9d3-9282bbaad547
SPF v=spf1 include:mailgun.org ~all
duo_sso_verification=dhFlnL9cZoy7na92QIsxPNSrSGTHcezShZMyEYrje3nhhLI9uPrDIzPsaAz...
1bpf3tgu0clh4h7mte1jubr70u
sbv5flvk2pkdq3e76mmnrrli8
MS=585E344DD5602BB42C97F00CA7BB76FA0F8C41F4
globalsign-domain-verification=68BF77350A1290277BE354B71A983F8C
SPF v=spf1 include:_spf.sierraclub.org include:_spf.google.com include:_spf.salesfor...
ZOOM_verify_JK16PB6bRcusiW_FlVtGPw
SFMC-K0zzqyWZlMjJFv92C2YatKuQvhb4Y43nYLjmPhV1
CAALookup not available with standard resolver
Resolved in 82 ms

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A
Redirect Chain
1 redirect(s), 533 ms total
PASS
1 redirect(s), 533 ms total
Info::
Single redirect
Got: https://sierraclub.org → https://www.sierraclub.org/ (301)
Info::
WWW normalization redirect
Info::
Redirect overhead: 533 ms total
Got: 533 ms

https://sierraclub.org

324 ms · HTTP/1.1

301

https://www.sierraclub.org/

209 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://sierraclub.org301324 msHTTP/1.1
2https://www.sierraclub.org/200209 msHTTP/1.1

See the visual redirect chain in the HTTP Probe tab →

A+
Crawlability
robots.txt present, sitemap with 2 URLs
PASS
robots.txt present, sitemap with 2 URLs
Info::
robots.txt is present
Got: 3200 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 2 entries
Info::
Sitemap index with 2 child sitemaps
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 3200 B Sitemaps referenced 1 User-agents Bytespider, PetalBot, ICC-Crawler, PanguBot, python-requests/2.31.0, Meta-ExternalAgent, Meta-ExternalFetcher, omgili, Crawlspace, Diffbot, AI2Bot, CCBot, cohere-ai, ImagesiftBot, img2dataset, Sidetrade indexer bot, Timpibot, Brightbot 1.0, Webzio-Extended, Ai2Bot-Dolma, Scrapy, SemrushBot-OCOB, VelenPublicWebCrawler, YouBot, Barkrowler, Kangaroo Bot, OAI-SearchBot, omgilibot, *, Amazonbot, ISSCyberRiskCrawler, SemrushBot-SWA, Scrapy/2.11.2, cohere-training-data-crawler, FriendlyCrawler, iaskspider/2.0, PerplexityBot, AhrefsBot, Go-http-client/2.0, anthropic-ai Blocking No — crawling allowed
#
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites like Yahoo!
# and Google. By telling these "robots" where not to go on your site,
# you save bandwidth and server resources.
#
# This file will be ignored unless it is at the root of your host:
# Used:    http://example.com/robots.txt
# Ignored: http://example.com/site/robots.txt
#
# For more information about the robots.txt standard, see:
# http://www.robotstxt.org/robotstxt.html

User-agent: *
# CSS, JS, Images
Allow: /core/*.css$
Allow: /core/*.css?
Allow: /core/*.js$
Allow: /core/*.js?
Allow: /core/*.gif
Allow: /core/*.jpg
Allow: /core/*.jpeg
Allow: /core/*.png
Allow: /core/*.svg
Allow: /profiles/*.css$
Allow: /profiles/*.css?
Allow: /profiles/*.js$
Allow: /profiles/*.js?
Allow: /profiles/*.gif
Allow: /profiles/*.jpg
Allow: /profiles/*.jpeg
Allow: /profiles/*.png
Allow: /profiles/*.svg
# Directories
Disallow: /core/
Disallow: /profiles/
# Files
Disallow: /README.md
Disallow: /composer/Metapackage/README.txt
Disallow: /composer/Plugin/ProjectMessage/README.md
Disallow: /composer/Plugin/Scaffold/README.md
Disallow: /composer/Plugin/VendorHardening/README.txt
Disallow: /composer/Template/README.txt
Disallow: /modules/README.txt
Disallow: /sites/README.txt
Disallow: /themes/README.txt
Disallow: /web.config
# Paths (clean URLs)
Disallow: /admin/
Disallow: /comment/reply/
Disallow: /filter/tips
Disallow: /node/add/
Disallow: /search/
Disallow: /user/register
Disallow: /user/password
Disallow: /user/login
Disallow: /user/logout
Disallow: /media/oembed
Disallow: /*/media/oembed
# Paths (no clean URLs)
Disallow: /index.php/admin/
Disallow: /index.php/comment/reply/
Disallow: /index.php/filter/tips
Disallow: /index.php/node/add/
Disallow: /index.php/search/
Disallow: /index.php/user/password
Disallow: /index.php/user/register
Disallow: /index.php/user/login
Disallow: /index.php/user/logout
Disallow: /index.php/media/oembed
Disallow: /index.php/*/media/oembed

# AI Bots from
# https://github.com/ai-robots-txt/ai.robots.txt/blob/main/robots.txt
User-agent: AI2Bot
User-agent: Ai2Bot-Dolma
User-agent: Amazonbot
User-agent: anthropic-ai
User-agent: Brightbot 1.0
User-agent: Bytespider
User-agent: CCBot
User-agent: cohere-ai
User-agent: cohere-training-data-crawler
User-agent: Crawlspace
User-agent: Diffbot
User-agent: FriendlyCrawler
User-agent: iaskspider/2.0
User-agent: ICC-Crawler
User-agent: ImagesiftBot
User-agent: img2dataset
User-agent: ISSCyberRiskCrawler
User-agent: Kangaroo Bot
User-agent: Meta-ExternalAgent
User-agent: Meta-ExternalFetcher
User-agent: OAI-SearchBot
User-agent: omgili
User-agent: omgilibot
User-agent: PanguBot
User-agent: PerplexityBot
User-agent: PetalBot
User-agent: Scrapy
User-agent: SemrushBot-OCOB
User-agent: SemrushBot-SWA
User-agent: Sidetrade indexer bot
User-agent: Timpibot
User-agent: VelenPublicWebCrawler
User-agent: Webzio-Extended
User-agent: YouBot
User-agent: AhrefsBot
User-agent: Barkrowler
User-agent: python-requests/2.31.0
User-agent: Go-http-client/2.0
User-agent: Scrapy/2.11.2
Disallow: /

User-agent: *
Crawl-delay: 10

Sitemap: https://www.sierraclub.org/sitemap.xml

sitemap.xml 200 OK
Type Sitemap Index URLs 2 entries Valid XML Yes
A+
Domain Intelligence
sierraclub.org — via GoDaddy.com, LLC, 32 years, 11 months old, hosted on INCAPSULA - Incapsula Inc, US
PASS
sierraclub.org — via GoDaddy.com, LLC, 32 years, 11 months old, hosted on INCAPSULA - Incapsula Inc, US
Info::
Domain registered until Oct 31, 2026 (6 months remaining)
Info::
DNSSEC is not enabled
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Info::
Registrar: GoDaddy.com, LLC
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Info::
Hosting: INCAPSULA - Incapsula Inc, US
Got: AS19551
Domain expiry

139 days

October 31, 2026

SSL certificate

172 days

Issued by GoDaddy.com, Inc.

Domain age

32 years, 11 months

Registered November 1, 1993

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

INCAPSULA - Incapsula Inc, US

ASN AS19551

199.83.134.200

Registrar

GoDaddy.com, LLC

Unlocked 5 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable DNSSEC to protect visitors from DNS spoofing
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar GoDaddy.com, LLC
Created November 1, 1993 (32 years, 11 months ago)
Expires October 31, 2026 (6 months)
Last Updated June 10, 2024
Name Servers ns0.dnsmadeeasy.com, ns1.dnsmadeeasy.com, ns2.dnsmadeeasy.com, ns3.dnsmadeeasy.com, ns4.dnsmadeeasy.com
DNSSEC Not enabled
Hosting
IP Address 199.83.134.200
ASN AS19551 (INCAPSULA - Incapsula Inc, US)
Provider INCAPSULA - Incapsula Inc, US
Data source: rdap (0.5s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 370 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
27 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
94 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
95 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
370 ms
Total Time Total request time from DNS lookup through full response.
370 ms

Connection waterfall

DNS Lookup 27 ms TCP Connect 94 ms TLS Handshake 95 ms Server Processing 153 ms Content Transfer 0 ms
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback