Skip to content
https://gitlab.com

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
96
GRADE
A
FIX
0
REVIEW
1
PASS
8
INFO
0
Probed from New York, United Stated
301 Moved Permanently
Checks
9
8 PASS 1 REVIEW
B
TLS Certificate Expiry & Recommendations
37 days until leaf cert expires — 4 issues to address
REVIEW

Certificate validity

37
days left
0d 30d 60d 90d+

Recommended actions

  • Add includeSubDomains to the HSTS directive
  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+
DNS Records
1 A records, 26 ms lookup
PASS
1 A records, 26 ms lookup
Info::
Resolves to 1 IPv4 address(es)
Got: 172.65.251.78
Info::
Single A record — no DNS redundancy
Multiple A records provide failover if one server goes down.
Info::
Has 1 IPv6 (AAAA) record(s)
Got: 2606:4700:90:0:f22e:fbec:5bed:a9b9
Info::
2 nameserver(s) configured
Got: diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
Info::
5 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 26 ms
Got: 26 ms
A172.65.251.78
AAAA2606:4700:90:0:f22e:fbec:5bed:a9b9
CNAME
NSdiva.ns.cloudflare.com, jermaine.ns.cloudflare.com
MX
1 aspmx.l.google.com
5 alt2.aspmx.l.google.com
5 alt1.aspmx.l.google.com
10 alt4.aspmx.l.google.com
10 alt3.aspmx.l.google.com
TXT
MS=ms83893381
serval-domain-verification-rahzqw=w9adwbCM3CJ9BrXnAleSWuMqz
google-site-verification=iWR2UGQb3MvVY83zY47ZFrGFVFLG6ADfpjqchlQjnok
docusign=1a7d6818-2cf5-4956-a9fb-c3d2e9a578dd
google-site-verification=uT9dAMjaTlnkbC0VnN5flFWp0Bsze7zHObWjZwkd2p8
_globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3
apple-domain-verification=UNUD9vY0Jp9z5TjO
zapier-domain-verification-challenge=a1d665be-8176-4ada-9707-4332dfa7a2cc
MS=ms60196128
onetrust-domain-verification=af5b5fda116e45a9b4c4abcd9e571923
gitlab-pages-verification-code=5228e61c992af7e65f5f5160f0587fb4
uber-domain-verification=38ba2b7b-5ae3-4694-9701-086b20ea3d36
openai-domain-verification=dv-Uq90dak9n7LidGh0WsdFOOUu
adobe-idp-site-verification=5a5e001556a2c0595ed571d2a1f7b5f8a749a00742853e035eb9...
v=MCPv1; k=ed25519; p=MmZM6XexKcX4jiWqHtn3M0av9Q7HDmonAdP6PqktwX0=
smartsheet-site-validation=wTADkxxpf97DU9ZxO4RuFpZJyRvP7MRm
onetrust-domain-verification=84b59aa2659244d486b0b86f5db073dd
mgverify=9549a96a4bc9886fbf483bcd56872eaf2b5b9e690d264024041cf446664cb114
google-site-verification=XDRo7LEOqv6OV0RfGDFh7G2XgpzdycygGJBqde334q4
stripe-verification=E331E16D59119AEFB547211475C2E225C1BF6EB8CB885D300536B2852EAD...
mgverify=2dd945066758840fe3bfbd9ccf90e2c6000458f13345baa576338880dcc86658
drift-domain-verification=fa583cfff88c496bcc62651057550656a98ab3e689c314255a1a6a...
google-site-verification=vPPg6DGiVgf5vhzQg5zGISLao6-07-lVzzpqvmCFe5Y
google-site-verification=lnPjOx5EAxmESH8FSn4colWVMAxe18K4ZIopDB1IEDY
jamf-site-verification=nRPNM9HJGzWzUkvBtgvBrg
SPF v=spf1 include:mail.zendesk.com include:_spf.google.com include:mktomail.com inc...
google-site-verification=QiG7NTIWpedorFi71mMN7OVe2Fo_yA6RclsxO8stOa8
google-site-verification=6Cb3PPpoMp6-xRavXf2HZz03s7pplQeG5MiUaPGIu_Q
asv=3f763643512ad5bdcc0d42caea1b3951
CAALookup not available with standard resolver
Resolved in 26 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A
Redirect Chain
1 redirect(s), 170 ms total
PASS
1 redirect(s), 170 ms total
Info::
Single redirect
Got: https://gitlab.com → https://about.gitlab.com/ (301)
Info::
Cross-domain redirect detected

https://gitlab.com

106 ms · HTTP/1.1

301

https://about.gitlab.com/

64 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://gitlab.com301106 msHTTP/1.1cloudflare
2https://about.gitlab.com/20064 msHTTP/1.1cloudflare

See the visual redirect chain in the HTTP Probe tab →

A+
IPv6 Readiness
IPv6 reachable (2 ms)
PASS
IPv6 reachable (2 ms)
Info::
IPv6 is configured and reachable at 2606:4700:90:0:f22e:fbec:5bed:a9b9
Got: 2 ms connect
IPv6 Ready
AAAA Records 2606:4700:90:0:f22e:fbec:5bed:a9b9 Connection Reachable (2 ms)
A+
Crawlability
robots.txt present, sitemap with 18493 URLs
PASS
robots.txt present, sitemap with 18493 URLs
Info::
robots.txt is present
Got: 3230 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 18493 entries
Info::
robots.txt does not reference a sitemap
Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Why this matters

robots.txt omits Sitemap: directive — crawlers must fetch /sitemap.xml by convention; reliable but missing the explicit hint.

Source: sitemaps.org

robots.txt 200 OK
Size 3230 B Sitemaps referenced 0 User-agents * Blocking No — crawling allowed
# See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file
#
# To ban all spiders from the entire site uncomment the next two lines:
# User-Agent: *
# Disallow: /

# Add a 1 second delay between successive requests to the same server, limits resources used by crawler
# Only some crawlers respect this setting, e.g. Googlebot does not
# Crawl-delay: 1

# Based on details in https://gitlab.com/gitlab-org/gitlab/blob/master/config/routes.rb,
# https://gitlab.com/gitlab-org/gitlab/blob/master/spec/routing, and using application

# Global routes
User-Agent: *
Disallow: /autocomplete/users
Disallow: /autocomplete/projects
Disallow: /search
Disallow: /admin
Disallow: /profile
Disallow: /dashboard
Disallow: /users
Disallow: /api/v*
Disallow: /help
Disallow: /s/
Disallow: /-/profile
Disallow: /-/profile/
Disallow: /-/user_settings/
Disallow: /-/ide/
Disallow: /-/experiment
# Restrict allowed routes to avoid very ugly search results
Allow: /users/sign_in
Allow: /users/sign_up
Allow: /users/*/snippets

# Generic resource routes like new, edit, raw
# This will block routes like:
# - /projects/new
# - /gitlab-org/gitlab-foss/issues/123/-/edit
User-Agent: *
Disallow: /*/new
Disallow: /*/edit
Disallow: /*/raw
Disallow: /*/realtime_changes

# Group details
User-Agent: *
Disallow: /groups/*/-/analytics
Disallow: /groups/*/-/analytics/
Disallow: /groups/*/-/insights/
Disallow: /groups/*/-/issues_analytics
Disallow: /groups/*/-/contribution_analytics
Disallow: /groups/*/-/group_members
Disallow: /groups/*/-/saml/
Disallow: /groups/*/-/saml_group_links
Disallow: /groups/*/-/settings/
Disallow: /groups/*/-/billings
Disallow: /groups/*/-/hooks
Disallow: /groups/*/-/projects

# Project details
User-Agent: *
Disallow: /*/*.git$
Disallow: /*/*.git/*
Disallow: /*/archive/
Disallow: /*/repository/archive*
Disallow: /*/activity
Disallow: /*/-/project_members
Disallow: /*/-/blame/
Disallow: /*/-/branches
Disallow: /*/-/commits/
Disallow: /*/-/commit
Disallow: /*/commit/*.patch
Disallow: /*/commit/*.diff
Disallow: /*/-/compare/
Disallow: /*/-/network/
Disallow: /*/path_locks
Disallow: /*/merge_requests/*.patch
Disallow: /*/merge_requests/*.diff
Disallow: /*/merge_requests/*/diffs
Disallow: /*/services
Disallow: /*/uploads/
Disallow: /*/-/import
Disallow: /*/-/requirements_management/
Disallow: /*/-/pipelines
Disallow: /*/-/pipeline_schedules
Disallow: /*/-/jobs
Disallow: /*/-/ci/
Disallow: /*/-/quality/
Disallow: /*/-/licenses
Disallow: /*/-/security/
Disallow: /*/-/dependencies
Disallow: /*/-/audit_events
Disallow: /*/-/on_demand_scans
Disallow: /*/-/feature_flags
Disallow: /*/-/ml/
Disallow: /*/-/environments
Disallow: /*/-/clusters
Disallow: /*/-/terraform
Disallow: /*/-/terraform_module_registry
Disallow: /*/-/*/configuration
Disallow: /*/-/error_tracking
Disallow: /*/-/metrics
Disallow: /*/-/alert_management
Disallow: /*/-/incidents
Disallow: /*/-/oncall_schedules
Disallow: /*/-/escalation_policies
Disallow: /*/-/*/service_desk
Disallow: /*/-/analytics
Disallow: /*/-/analytics/
Disallow: /*/-/value_stream_analytics
Disallow: /*/-/graphs/
Disallow: /*/insights/
Disallow: /*/-/pipelines/
Disallow: /*/-/settings/
Disallow: /*/-/hooks
Disallow: /*/-/usage_quotas

A+
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Info::
HTTP correctly 301-redirects to HTTPS

www / non-www

308https://www.gitlab.com/
200https://gitlab.com/

HTTP → HTTPS

301http://gitlab.com/ https://gitlab.com/

Consistent

A+
Domain Intelligence
gitlab.com — via Gandi SAS, 22 years, 6 months old
PASS
gitlab.com — via Gandi SAS, 22 years, 6 months old
Info::
Domain registered until Jan 15, 2027 (9 months remaining)
Info::
DNSSEC is not enabled
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Info::
Registrar: Gandi SAS
Domain expiry

214 days

January 15, 2027

SSL certificate

37 days

Issued by Sectigo Limited

Domain age

22 years, 6 months

Registered January 15, 2004

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

Unknown

2606:4700:90:0:f22e:fbec:5bed:a9b9

Registrar

Gandi SAS

Lock status unknown 2 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable DNSSEC to protect visitors from DNS spoofing
Registrar Gandi SAS
Created January 15, 2004 (22 years, 6 months ago)
Expires January 15, 2027 (9 months)
Last Updated December 11, 2025
Name Servers diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
DNSSEC Not enabled
Hosting
IP Address 2606:4700:90:0:f22e:fbec:5bed:a9b9
Data source: rdap (0.1s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

A+
HTTP Probe Timing
Total 126 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
18 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
2 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
10 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
127 ms
Total Time Total request time from DNS lookup through full response.
127 ms

Connection waterfall

DNS Lookup 18 ms TCP Connect 2 ms TLS Handshake 10 ms Server Processing 97 ms Content Transfer 0 ms
A
CDN & Delivery
Cloudflare (MISS)
PASS
Cloudflare (MISS)
Info::
Site is served via Cloudflare CDN (edge: EWR)
Got: cf-ray: 9e71c4ccbd327ca0-EWR
Info::
CDN cache status: MISS
CDN Detected: Cloudflare
Provider Cloudflare Cache Status MISS Evidence cf-ray: 9e71c4ccbd327ca0-EWR
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback