Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.BTLS Certificate Expiry & Recommendations37 days until leaf cert expires — 4 issues to addressREVIEW
Certificate validity
Recommended actions
- Add includeSubDomains to the HSTS directive
- Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
- Enable DNSSEC on your domain for DNS spoofing protection
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+DNS Records1 A records, 26 ms lookupPASS
| A | 172.65.251.78 |
| AAAA | 2606:4700:90:0:f22e:fbec:5bed:a9b9 |
| CNAME | — |
| NS | diva.ns.cloudflare.com, jermaine.ns.cloudflare.com |
| MX | 1 aspmx.l.google.com 5 alt2.aspmx.l.google.com 5 alt1.aspmx.l.google.com 10 alt4.aspmx.l.google.com 10 alt3.aspmx.l.google.com |
| TXT | MS=ms83893381 serval-domain-verification-rahzqw=w9adwbCM3CJ9BrXnAleSWuMqz google-site-verification=iWR2UGQb3MvVY83zY47ZFrGFVFLG6ADfpjqchlQjnok docusign=1a7d6818-2cf5-4956-a9fb-c3d2e9a578dd google-site-verification=uT9dAMjaTlnkbC0VnN5flFWp0Bsze7zHObWjZwkd2p8 _globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3 apple-domain-verification=UNUD9vY0Jp9z5TjO zapier-domain-verification-challenge=a1d665be-8176-4ada-9707-4332dfa7a2cc MS=ms60196128 onetrust-domain-verification=af5b5fda116e45a9b4c4abcd9e571923 gitlab-pages-verification-code=5228e61c992af7e65f5f5160f0587fb4 uber-domain-verification=38ba2b7b-5ae3-4694-9701-086b20ea3d36 openai-domain-verification=dv-Uq90dak9n7LidGh0WsdFOOUu adobe-idp-site-verification=5a5e001556a2c0595ed571d2a1f7b5f8a749a00742853e035eb9... v=MCPv1; k=ed25519; p=MmZM6XexKcX4jiWqHtn3M0av9Q7HDmonAdP6PqktwX0= smartsheet-site-validation=wTADkxxpf97DU9ZxO4RuFpZJyRvP7MRm onetrust-domain-verification=84b59aa2659244d486b0b86f5db073dd mgverify=9549a96a4bc9886fbf483bcd56872eaf2b5b9e690d264024041cf446664cb114 google-site-verification=XDRo7LEOqv6OV0RfGDFh7G2XgpzdycygGJBqde334q4 stripe-verification=E331E16D59119AEFB547211475C2E225C1BF6EB8CB885D300536B2852EAD... mgverify=2dd945066758840fe3bfbd9ccf90e2c6000458f13345baa576338880dcc86658 drift-domain-verification=fa583cfff88c496bcc62651057550656a98ab3e689c314255a1a6a... google-site-verification=vPPg6DGiVgf5vhzQg5zGISLao6-07-lVzzpqvmCFe5Y google-site-verification=lnPjOx5EAxmESH8FSn4colWVMAxe18K4ZIopDB1IEDY jamf-site-verification=nRPNM9HJGzWzUkvBtgvBrg SPF v=spf1 include:mail.zendesk.com include:_spf.google.com include:mktomail.com inc... google-site-verification=QiG7NTIWpedorFi71mMN7OVe2Fo_yA6RclsxO8stOa8 google-site-verification=6Cb3PPpoMp6-xRavXf2HZz03s7pplQeG5MiUaPGIu_Q asv=3f763643512ad5bdcc0d42caea1b3951 |
| CAA | Lookup not available with standard resolver |
Multiple A records provide failover if one server goes down.
Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.
Learn more ▾ ▴
Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.
Source: SRE practice / DNS architecture
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
ARedirect Chain1 redirect(s), 170 ms totalPASS
https://gitlab.com
106 ms · HTTP/1.1
https://about.gitlab.com/
64 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://gitlab.com | 301 | 106 ms | HTTP/1.1 | cloudflare |
| 2 | https://about.gitlab.com/ | 200 | 64 ms | HTTP/1.1 | cloudflare |
See the visual redirect chain in the HTTP Probe tab →
A+IPv6 ReadinessIPv6 reachable (2 ms)PASS
A+Crawlabilityrobots.txt present, sitemap with 18493 URLsPASS
Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.
robots.txt omits Sitemap: directive — crawlers must fetch /sitemap.xml by convention; reliable but missing the explicit hint.
Source: sitemaps.org
# See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file
#
# To ban all spiders from the entire site uncomment the next two lines:
# User-Agent: *
# Disallow: /
# Add a 1 second delay between successive requests to the same server, limits resources used by crawler
# Only some crawlers respect this setting, e.g. Googlebot does not
# Crawl-delay: 1
# Based on details in https://gitlab.com/gitlab-org/gitlab/blob/master/config/routes.rb,
# https://gitlab.com/gitlab-org/gitlab/blob/master/spec/routing, and using application
# Global routes
User-Agent: *
Disallow: /autocomplete/users
Disallow: /autocomplete/projects
Disallow: /search
Disallow: /admin
Disallow: /profile
Disallow: /dashboard
Disallow: /users
Disallow: /api/v*
Disallow: /help
Disallow: /s/
Disallow: /-/profile
Disallow: /-/profile/
Disallow: /-/user_settings/
Disallow: /-/ide/
Disallow: /-/experiment
# Restrict allowed routes to avoid very ugly search results
Allow: /users/sign_in
Allow: /users/sign_up
Allow: /users/*/snippets
# Generic resource routes like new, edit, raw
# This will block routes like:
# - /projects/new
# - /gitlab-org/gitlab-foss/issues/123/-/edit
User-Agent: *
Disallow: /*/new
Disallow: /*/edit
Disallow: /*/raw
Disallow: /*/realtime_changes
# Group details
User-Agent: *
Disallow: /groups/*/-/analytics
Disallow: /groups/*/-/analytics/
Disallow: /groups/*/-/insights/
Disallow: /groups/*/-/issues_analytics
Disallow: /groups/*/-/contribution_analytics
Disallow: /groups/*/-/group_members
Disallow: /groups/*/-/saml/
Disallow: /groups/*/-/saml_group_links
Disallow: /groups/*/-/settings/
Disallow: /groups/*/-/billings
Disallow: /groups/*/-/hooks
Disallow: /groups/*/-/projects
# Project details
User-Agent: *
Disallow: /*/*.git$
Disallow: /*/*.git/*
Disallow: /*/archive/
Disallow: /*/repository/archive*
Disallow: /*/activity
Disallow: /*/-/project_members
Disallow: /*/-/blame/
Disallow: /*/-/branches
Disallow: /*/-/commits/
Disallow: /*/-/commit
Disallow: /*/commit/*.patch
Disallow: /*/commit/*.diff
Disallow: /*/-/compare/
Disallow: /*/-/network/
Disallow: /*/path_locks
Disallow: /*/merge_requests/*.patch
Disallow: /*/merge_requests/*.diff
Disallow: /*/merge_requests/*/diffs
Disallow: /*/services
Disallow: /*/uploads/
Disallow: /*/-/import
Disallow: /*/-/requirements_management/
Disallow: /*/-/pipelines
Disallow: /*/-/pipeline_schedules
Disallow: /*/-/jobs
Disallow: /*/-/ci/
Disallow: /*/-/quality/
Disallow: /*/-/licenses
Disallow: /*/-/security/
Disallow: /*/-/dependencies
Disallow: /*/-/audit_events
Disallow: /*/-/on_demand_scans
Disallow: /*/-/feature_flags
Disallow: /*/-/ml/
Disallow: /*/-/environments
Disallow: /*/-/clusters
Disallow: /*/-/terraform
Disallow: /*/-/terraform_module_registry
Disallow: /*/-/*/configuration
Disallow: /*/-/error_tracking
Disallow: /*/-/metrics
Disallow: /*/-/alert_management
Disallow: /*/-/incidents
Disallow: /*/-/oncall_schedules
Disallow: /*/-/escalation_policies
Disallow: /*/-/*/service_desk
Disallow: /*/-/analytics
Disallow: /*/-/analytics/
Disallow: /*/-/value_stream_analytics
Disallow: /*/-/graphs/
Disallow: /*/insights/
Disallow: /*/-/pipelines/
Disallow: /*/-/settings/
Disallow: /*/-/hooks
Disallow: /*/-/usage_quotas
A+URL Variantswww/non-www, trailing slash, HTTP→HTTPSPASS
www / non-www
HTTP → HTTPS
Consistent
A+Domain Intelligencegitlab.com — via Gandi SAS, 22 years, 6 months oldPASS
214 days
January 15, 2027
37 days
Issued by Sectigo Limited
22 years, 6 months
Registered January 15, 2004
Not enabled
Protects against DNS spoofing
Unknown
2606:4700:90:0:f22e:fbec:5bed:a9b9
Gandi SAS
Expiry timeline
Recommended actions
- Enable DNSSEC to protect visitors from DNS spoofing
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.
Learn more ▾ ▴
DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.
Source: ICANN / RFC 4033