Skip to content
https://gitlab.com/users/sign_in

Infrastructure

· 17 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
87
GRADE
B
FIX
1
REVIEW
6
PASS
10
INFO
0
Probed from New York, United Stated
403 Forbidden
Checks
17
10 PASS 6 REVIEW 1 FIX
F
IPv6 Readiness
Action
IPv6 records exist but unreachable
FIX
IPv6 records exist but unreachable
Warning::
IPv6 DNS records exist but server is not reachable
Having AAAA records but an unreachable server is worse than no AAAA — clients may experience delays before falling back to IPv4.
Got: 2606:4700:90:0:f22e:fbec:5bed:a9b9
Info::
IPv6 connection error
Got: dial tcp6 [2606:4700:90:0:f22e:fbec:5bed:a9b9]:443: connect: no route to host
IPv6 Misconfigured
AAAA Records 2606:4700:90:0:f22e:fbec:5bed:a9b9 Connection UNREACHABLE

Having AAAA records but an unreachable server is worse than no AAAA — clients may experience delays before falling back to IPv4.

Why this matters

Advertising IPv6 (AAAA records) without a reachable server means IPv6-preferring clients silently fail every connection.

Learn more

Modern browsers prefer IPv6 if AAAA exists (Happy Eyeballs algorithm). If the IPv6 server isn't reachable, browsers fall back to IPv4 — but with seconds of added latency per request. Either fix IPv6 reachability or remove the AAAA records.

Source: RFC 8305 (Happy Eyeballs)

B
DNSSEC
Unsigned (DNSSEC not deployed)
REVIEW
Unsigned (DNSSEC not deployed)
Info::
DNSSEC is not deployed
The zone is not DNSSEC-signed. Users on validating resolvers (Cloudflare 1.1.1.1, Quad9 9.9.9.9, growing default in mobile resolvers) get no protection against DNS spoofing for this domain. Most registrars now offer DNSSEC at a single click; consider enabling it for sites where authenticity matters (banking, healthcare, government).
C
Reverse DNS
Action
0/2 IPs match cert SAN
REVIEW
0/2 IPs match cert SAN
Info::
PTR lookup failed for 172.65.251.78: lookup 172.65.251.78: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
Info::
PTR lookup failed for 2606:4700:90:0:f22e:fbec:5bed:a9b9: lookup 2606:4700:90:0:f22e:fbec:5bed:a9b9: no such host
No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
B
TLS Certificate Expiry & Recommendations
185 days until leaf cert expires — 3 issues to address
REVIEW

Certificate validity

185
days left
0d 30d 60d 90d+

Recommended actions

  • Add includeSubDomains to the HSTS directive
  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable DNSSEC on your domain for DNS spoofing protection
B
CDN & Delivery
Cloudflare
REVIEW
Cloudflare
Info::
Site is served via Cloudflare CDN (edge: EWR)
Got: cf-ray: 9f8fb71daaddaded-EWR
CDN Detected: Cloudflare
Provider Cloudflare Evidence cf-ray: 9f8fb71daaddaded-EWR
B
CDN Cache Observability
No CDN cache-status headers in the response
REVIEW
No CDN cache-status headers in the response
Info::
No CDN cache-status headers in the response
Without an X-Cache / CF-Cache-Status / X-Vercel-Cache / Age header, you can't tell from outside whether a request hit the cache or went to origin. Operationally important: enables debugging stale-content reports and verifying cache rules. Most managed CDN platforms emit at least one of these by default; absence often means the platform's diagnostic headers are stripped at an upstream proxy.
B
Operational Status Page
No status page link detected
REVIEW
No status page link detected
Info::
No operational status page link detected
Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.
A+
DNS Records
1 A records, 8 ms lookup
PASS
1 A records, 8 ms lookup
Info::
Resolves to 1 IPv4 address(es)
Got: 172.65.251.78
Info::
Single A record — no DNS redundancy
Multiple A records provide failover if one server goes down.
Info::
Has 1 IPv6 (AAAA) record(s)
Got: 2606:4700:90:0:f22e:fbec:5bed:a9b9
Info::
2 nameserver(s) configured
Got: diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
Info::
5 mail exchanger(s) configured
Info::
SPF record present in TXT
Info::
DNS resolution time: 8 ms
Got: 8 ms
A172.65.251.78
AAAA2606:4700:90:0:f22e:fbec:5bed:a9b9
CNAME
NSdiva.ns.cloudflare.com, jermaine.ns.cloudflare.com
MX
1 aspmx.l.google.com
5 alt2.aspmx.l.google.com
5 alt1.aspmx.l.google.com
10 alt4.aspmx.l.google.com
10 alt3.aspmx.l.google.com
TXT
MS=ms60523131
MS=ms83893381
_globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3
adobe-idp-site-verification=5a5e001556a2c0595ed571d2a1f7b5f8a749a00742853e035eb9...
apple-domain-verification=UNUD9vY0Jp9z5TjO
asv=3f763643512ad5bdcc0d42caea1b3951
docusign=1a7d6818-2cf5-4956-a9fb-c3d2e9a578dd
drift-domain-verification=fa583cfff88c496bcc62651057550656a98ab3e689c314255a1a6a...
gitlab-pages-verification-code=5228e61c992af7e65f5f5160f0587fb4
google-site-verification=6Cb3PPpoMp6-xRavXf2HZz03s7pplQeG5MiUaPGIu_Q
google-site-verification=QiG7NTIWpedorFi71mMN7OVe2Fo_yA6RclsxO8stOa8
google-site-verification=XDRo7LEOqv6OV0RfGDFh7G2XgpzdycygGJBqde334q4
google-site-verification=iWR2UGQb3MvVY83zY47ZFrGFVFLG6ADfpjqchlQjnok
google-site-verification=lnPjOx5EAxmESH8FSn4colWVMAxe18K4ZIopDB1IEDY
google-site-verification=uT9dAMjaTlnkbC0VnN5flFWp0Bsze7zHObWjZwkd2p8
google-site-verification=vPPg6DGiVgf5vhzQg5zGISLao6-07-lVzzpqvmCFe5Y
jamf-site-verification=nRPNM9HJGzWzUkvBtgvBrg
mgverify=2dd945066758840fe3bfbd9ccf90e2c6000458f13345baa576338880dcc86658
mgverify=9549a96a4bc9886fbf483bcd56872eaf2b5b9e690d264024041cf446664cb114
onetrust-domain-verification=84b59aa2659244d486b0b86f5db073dd
onetrust-domain-verification=af5b5fda116e45a9b4c4abcd9e571923
openai-domain-verification=dv-Uq90dak9n7LidGh0WsdFOOUu
serval-domain-verification-rahzqw=w9adwbCM3CJ9BrXnAleSWuMqz
smartsheet-site-validation=wTADkxxpf97DU9ZxO4RuFpZJyRvP7MRm
stripe-verification=E331E16D59119AEFB547211475C2E225C1BF6EB8CB885D300536B2852EAD...
uber-domain-verification=38ba2b7b-5ae3-4694-9701-086b20ea3d36
v=MCPv1; k=ed25519; p=MmZM6XexKcX4jiWqHtn3M0av9Q7HDmonAdP6PqktwX0=
SPF v=spf1 include:mail.zendesk.com include:_spf.google.com include:mktomail.com inc...
zapier-domain-verification-challenge=a1d665be-8176-4ada-9707-4332dfa7a2cc
CAALookup not available with standard resolver
Resolved in 8 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

A+
Subdomain Takeover
No subdomain takeover risk detected
PASS
No subdomain takeover risk detected
Info::
No CNAME record present
A+
CAA Records
issue: amazon.com, amazonaws.com, amazontrust.com, awstrust.com, comodoca.com, digicert.com, globalsign.com, letsencrypt.org, pki.goog, sectigo.com, ssl.com | issuewild: comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com | iodef configured
PASS
issue: amazon.com, amazonaws.com, amazontrust.com, awstrust.com, comodoca.com, digicert.com, globalsign.com, letsencrypt.org, pki.goog, sectigo.com, ssl.com | issuewild: comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com | iodef configured
Info::
CAA issue tag present — authorized CA(s): amazon.com, amazonaws.com, amazontrust.com, awstrust.com, comodoca.com, digicert.com, globalsign.com, letsencrypt.org, pki.goog, sectigo.com, ssl.com
Info::
CAA iodef tag present (failed-issuance notifications enabled)
A+
Multi-Resolver DNS Speed
Mean 4ms across 3 resolvers (spread 10ms)
PASS
Mean 4ms across 3 resolvers (spread 10ms)
Info::
Quad9: 0ms
Got: 0ms via 9.9.9.9:53
Info::
Cloudflare: 2ms
Got: 2ms via 1.1.1.1:53
Info::
Google: 10ms
Got: 10ms via 8.8.8.8:53
A+
Redirect Chain
0 redirect(s), 20 ms total
PASS
0 redirect(s), 20 ms total

https://gitlab.com/users/sign_in

20 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://gitlab.com/users/sign_in40320 msHTTP/1.1cloudflare
A+
Crawlability
robots.txt present, sitemap with 18542 URLs
PASS
robots.txt present, sitemap with 18542 URLs
Info::
robots.txt is present
Got: 3230 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 18542 entries
Info::
robots.txt does not reference a sitemap
Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Why this matters

robots.txt omits Sitemap: directive — crawlers must fetch /sitemap.xml by convention; reliable but missing the explicit hint.

Source: sitemaps.org

robots.txt 200 OK
Size 3230 B Sitemaps referenced 0 User-agents * Blocking No — crawling allowed
# See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file
#
# To ban all spiders from the entire site uncomment the next two lines:
# User-Agent: *
# Disallow: /

# Add a 1 second delay between successive requests to the same server, limits resources used by crawler
# Only some crawlers respect this setting, e.g. Googlebot does not
# Crawl-delay: 1

# Based on details in https://gitlab.com/gitlab-org/gitlab/blob/master/config/routes.rb,
# https://gitlab.com/gitlab-org/gitlab/blob/master/spec/routing, and using application

# Global routes
User-Agent: *
Disallow: /autocomplete/users
Disallow: /autocomplete/projects
Disallow: /search
Disallow: /admin
Disallow: /profile
Disallow: /dashboard
Disallow: /users
Disallow: /api/v*
Disallow: /help
Disallow: /s/
Disallow: /-/profile
Disallow: /-/profile/
Disallow: /-/user_settings/
Disallow: /-/ide/
Disallow: /-/experiment
# Restrict allowed routes to avoid very ugly search results
Allow: /users/sign_in
Allow: /users/sign_up
Allow: /users/*/snippets

# Generic resource routes like new, edit, raw
# This will block routes like:
# - /projects/new
# - /gitlab-org/gitlab-foss/issues/123/-/edit
User-Agent: *
Disallow: /*/new
Disallow: /*/edit
Disallow: /*/raw
Disallow: /*/realtime_changes

# Group details
User-Agent: *
Disallow: /groups/*/-/analytics
Disallow: /groups/*/-/analytics/
Disallow: /groups/*/-/insights/
Disallow: /groups/*/-/issues_analytics
Disallow: /groups/*/-/contribution_analytics
Disallow: /groups/*/-/group_members
Disallow: /groups/*/-/saml/
Disallow: /groups/*/-/saml_group_links
Disallow: /groups/*/-/settings/
Disallow: /groups/*/-/billings
Disallow: /groups/*/-/hooks
Disallow: /groups/*/-/projects

# Project details
User-Agent: *
Disallow: /*/*.git$
Disallow: /*/*.git/*
Disallow: /*/archive/
Disallow: /*/repository/archive*
Disallow: /*/activity
Disallow: /*/-/project_members
Disallow: /*/-/blame/
Disallow: /*/-/branches
Disallow: /*/-/commits/
Disallow: /*/-/commit
Disallow: /*/commit/*.patch
Disallow: /*/commit/*.diff
Disallow: /*/-/compare/
Disallow: /*/-/network/
Disallow: /*/path_locks
Disallow: /*/merge_requests/*.patch
Disallow: /*/merge_requests/*.diff
Disallow: /*/merge_requests/*/diffs
Disallow: /*/services
Disallow: /*/uploads/
Disallow: /*/-/import
Disallow: /*/-/requirements_management/
Disallow: /*/-/pipelines
Disallow: /*/-/pipeline_schedules
Disallow: /*/-/jobs
Disallow: /*/-/ci/
Disallow: /*/-/quality/
Disallow: /*/-/licenses
Disallow: /*/-/security/
Disallow: /*/-/dependencies
Disallow: /*/-/audit_events
Disallow: /*/-/on_demand_scans
Disallow: /*/-/feature_flags
Disallow: /*/-/ml/
Disallow: /*/-/environments
Disallow: /*/-/clusters
Disallow: /*/-/terraform
Disallow: /*/-/terraform_module_registry
Disallow: /*/-/*/configuration
Disallow: /*/-/error_tracking
Disallow: /*/-/metrics
Disallow: /*/-/alert_management
Disallow: /*/-/incidents
Disallow: /*/-/oncall_schedules
Disallow: /*/-/escalation_policies
Disallow: /*/-/*/service_desk
Disallow: /*/-/analytics
Disallow: /*/-/analytics/
Disallow: /*/-/value_stream_analytics
Disallow: /*/-/graphs/
Disallow: /*/insights/
Disallow: /*/-/pipelines/
Disallow: /*/-/settings/
Disallow: /*/-/hooks
Disallow: /*/-/usage_quotas

A+
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Info::
HTTP correctly 301-redirects to HTTPS

www / non-www

308https://www.gitlab.com/users/sign_in
200https://gitlab.com/users/sign_in

Trailing Slash

403https://gitlab.com/users/sign_in/
200https://gitlab.com/users/sign_in

HTTP → HTTPS

301http://gitlab.com/users/sign_in https://gitlab.com/users/sign_in

Consistent

A+
Domain Intelligence
gitlab.com — via Gandi SAS, 22 years, 7 months old
PASS
gitlab.com — via Gandi SAS, 22 years, 7 months old
Info::
Domain registered until Jan 15, 2027 (8 months remaining)
Info::
DNSSEC is not enabled
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Info::
Registrar: Gandi SAS
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Domain expiry

243 days

January 15, 2027

SSL certificate

185 days

Issued by Sectigo Limited

Domain age

22 years, 7 months

Registered January 15, 2004

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

Unknown

2606:4700:90:0:f22e:fbec:5bed:a9b9

Registrar

Gandi SAS

Unlocked 2 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable DNSSEC to protect visitors from DNS spoofing
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar Gandi SAS
Created January 15, 2004 (22 years, 7 months ago)
Expires January 15, 2027 (8 months)
Last Updated December 11, 2025
Name Servers diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
DNSSEC Not enabled
Hosting
IP Address 2606:4700:90:0:f22e:fbec:5bed:a9b9
Data source: rdap (0.0s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 20 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
3 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
2 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
9 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
20 ms
Total Time Total request time from DNS lookup through full response.
21 ms

Connection waterfall

DNS Lookup 3 ms TCP Connect 2 ms TLS Handshake 9 ms Server Processing 7 ms Content Transfer 0 ms
A+
Health Check Endpoint
Health endpoint at https://gitlab.com/health (HTTP 200)
PASS
Health endpoint at https://gitlab.com/health (HTTP 200)
Info::
Public health endpoint at https://gitlab.com/health
Got: https://gitlab.com/health
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback