Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.BRedirect Chain2 redirect(s), 507 ms totalREVIEW
https://goodrx.com
7 ms · HTTP/1.1
https://www.goodrx.com/
82 ms · HTTP/1.1
https://blocked.goodrx.com
418 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://goodrx.com | 301 | 7 ms | HTTP/1.1 | Varnish |
| 2 | https://www.goodrx.com/ | 302 | 82 ms | HTTP/1.1 | Varnish |
| 3 | https://blocked.goodrx.com | 200 | 418 ms | HTTP/1.1 | AmazonS3 |
See the visual redirect chain in the HTTP Probe tab →
Each redirect adds latency. Try to minimize the chain to 1 hop.
Redirect chain — each hop adds latency; combine into one redirect where possible.
Source: Google Search Central / web.dev
If permanent, use 301 instead.
302 (Found) is for genuinely temporary redirects — if this redirect is permanent, switch to 301 to preserve SEO equity.
Learn more ▾ ▴
Search engines treat 302 as temporary, keeping the original URL indexed and not transferring full link equity to the destination. Use 301 (Moved Permanently) for permanent redirects (HTTP→HTTPS, www-vs-non-www, URL restructures).
Source: Google Search Central
CIPv6 ReadinessActionNo IPv6 supportREVIEW
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.
Source: Google IPv6 stats
BTLS Certificate Expiry & Recommendations261 days until leaf cert expires — 5 issues to addressREVIEW
Certificate validity
Recommended actions
- Prefer TLS 1.3 — TLS 1.2 is acceptable but TLS 1.3 removes RSA key exchange and improves latency
- Add includeSubDomains to the HSTS directive
- Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
- Enable DNSSEC on your domain for DNS spoofing protection
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+DNS Records4 A records, 138 ms lookupPASS
| A | 151.101.194.49, 151.101.66.49, 151.101.130.49, 151.101.2.49 |
| AAAA | — |
| CNAME | — |
| NS | ns-594.awsdns-10.net, ns-1404.awsdns-47.org, ns-1770.awsdns-29.co.uk, ns-411.awsdns-51.com |
| MX | 10 aspmx.l.google.com 20 alt1.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 aspmx2.googlemail.com 50 aspmx3.googlemail.com |
| TXT | google-site-verification=pL6OmFqrVMwY6amd-IYSjsukCOb_vMhns4NAC_Ltu_E google-site-verification=bQkPHsTxsaC0DVVLZyNuPSn-LCXM7SRXyLabsoiUw8E anthropic-domain-verification-5q6t69=tsoXNNqQ2cxCSFcruJLp6cAGo sending_domain1107402=812372c10c5510569701623bf4a18257420987424d1d3f754c0a22ba9a... docusign=bc2f92c6-e126-439d-918f-ceccb3909d28 h1-domain-verification=NE5J5mTjq7vxd8oPEvFcQDCVemeexUvvMhanigzeRtYTXhxr liveramp-site-verification=j14Hjt_CEpcFx_Jd4eFG1NdltF2P79prlkHAepXMj3g google-site-verification=xhRHduR1IfH9UIlEClofM-R-ukQQ3yuJuwn_JqbWTmU stripe-verification=3bd0217d2646323c46fb8c55b674d399499e6b97063719d744d6d6d7cc1f... apple-domain-verification=Qip7T4LAJgt76ts9 robin-domain-verification-p02bfa=7GEZzXuZhIESPJ4h70WIHKeFz CD745DDA6C _globalsign-domain-verification=VmtaawP5k5JRiQ4X3iyQWrLP5VRAybwdCbW8PcvrGu SPF v=spf1 include:m.lessonly.com include:_spf.google.com include:_spf.salesforce.co... apple-domain-verification=ULwhFg5pZ-UMgIRMST7J5k0kEIkngCCO-ETh9DOpk2Y google-site-verification=hTK8ceNUKqLpYfLyI03CBFj41L1qdeYLGTHMpjhHkKM _globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3 MS=BBF593DDF48464506A198736777B968B5C933992 _globalsign-domain-verification=BHpWxHhQlVmC0Qh679dy4Ss6Rgh7znn8Rq7XF2qe6V facebook-domain-verification=upfrxujlwdu8yotvu41uzim4mzqsm9 pardot1107402=c1c2c9a0c361ab811626c893e6047f50607fc1f5974ddbd312c55e5365c9e841 pardot1107402=eb1136e578c5cc5407baeb60e373356327872930ebd5ca491acbde82487acdb8 globalsign-domain-verification=081A67CE91C10203100F89EAD50BF7B1 jamf-site-verification=Chw3bRSoAwI0HmBdooJHSg google-site-verification=Mjmo1EMQg89B931bJmnEpVyMIZlngfjuhtKTHvSMgw4 loaderio=26b05173dbe31e0d1552a5c3dbfa7e1a onetrust-domain-verification=ec338ad623954b1fa0029d549b7acf04 atlassian-domain-verification=tny5glhS7sb0s6V0eqgbjuVB0zt6vt+iBoIk56eEto2HPIUgQd... _globalsign-domain-verification=iRl7LRCkBgH6_cc6FljPk98rDj2QFqhK5SbtgchBGh amazonses:zdTy1RqJYWQLfVLeeVCuzkyvxzoowzxcj5QFwEO8tyA= _globalsign-domain-verification=-lBuNJDFRxDkLkNbYOLBU03PlWjnPqAzBPAVUokhAw google-site-verification=0HCfwSPj99hPK2yKZqYCLXOCYXXMrDZr3H6fFI56oZI stripe-verification=7b539566b7b4d8fcaf55e833195b2352d378655a9f93d95a74180858ab6e... _2rbpmubrszremvsq0yoofcrogo7dj2s openai-domain-verification=dv-9TQ9DVJypJqUQb9lug2Tu1e2 F283923BA6 lunar-verification=c462ee76-59de-42ad-8467-d85a3e41acd8 onetrust-domain-verification=4fdc4e24d37a486f8fbf0f49528b85f6 miro-verification=2d3569e77447fd807da9602fa827b0cf82de31d2 cursor-domain-verification-wbwek9=IXRnItwnVYqfvWCbw2yyD6ajr google-site-verification=jyHKqaW5Yaxb8GNN5FHUHz_aCXmsalPq0fbwxYh0rjQ google-site-verification=9VELXk8F3xwoXat3SlF1UQWRr7aBq1ui2RJ5WXT85pw apple-domain-verification=aWJonu6lBJVo6anY |
| CAA | Lookup not available with standard resolver |
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
ACrawlabilityrobots.txt present, sitemap with 0 URLsPASS
An empty sitemap provides no value. Add <url> entries for your pages.
An empty sitemap signals 'no content to index' to Google — actively harmful versus having no sitemap at all.
Learn more ▾ ▴
Google compares URLs in the sitemap against URLs it has crawled. An empty sitemap on a site with thousands of pages signals abandonment. Either populate it correctly (most CMSes auto-generate) or delete the file and let Google crawl normally.
Source: Google Search Central / sitemaps.org
# Hey there! You don't look like a robot...
#
# We'd love to hear from curious humans such as yourself.
#
# While you're poking around, why not check out our open positions at GoodRx?
#
# https://www.goodrx.com/jobs
#
# Or reach out directly via seo@goodrx.com
#
# If you are in fact a robot, pardon my presumptions. Here's what you came for:
User-agent: *
Disallow: /static
Disallow: /discount-card-sign-up
Disallow: /ajax
Disallow: /clear-location
Disallow: /change-location
Disallow: /reset-location
Disallow: /price-alert
Disallow: /coupon
Disallow: /doctors/price-guide
Disallow: /browse
Disallow: /my-rx
Disallow: /widget
Disallow: /mobile-api
Disallow: /iframe
Disallow: /blog/feed
Disallow: /compounded-drugs
Disallow: /compounded-drugs/*
Disallow: /esrx-mail-order
Disallow: /maintenance
Disallow: /discount-card/*
Disallow: /store
Disallow: /webview
Disallow: /auth0/*
Disallow: /good-data/*
Disallow: /*?_pxhc=*
Disallow: /optimizely-edge/*
Disallow: /search?*
Disallow: /*?sponsorship*
Disallow: /*?prices_first*
Disallow: /*?insurance*
Disallow: /*?sort_type*
Disallow: /*?deliveryType*
Disallow: /*?offerId*
Disallow: /transfer/drug/*
Disallow: /send-ahead/drug/*
Disallow: /go/
Disallow: /*?*client=*
User-agent: TagInspector
Allow: /
Sitemap: https://www.goodrx.com/sitemap.xml
A+URL Variantswww/non-www, trailing slash, HTTP→HTTPSPASS
www / non-www
Preferred variant: non-www
HTTP → HTTPS
Consistent
A+Domain Intelligencegoodrx.com — via GoDaddy.com, LLC, 14 years, 11 months old, hosted on FastlyPASS
1106 days
July 24, 2029
261 days
Issued by GlobalSign nv-sa
14 years, 11 months
Registered July 24, 2011
Not enabled
Protects against DNS spoofing
Fastly
ASN AS54113
151.101.130.49
GoDaddy.com, LLC
Expiry timeline
Recommended actions
- Enable DNSSEC to protect visitors from DNS spoofing
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.
Learn more ▾ ▴
DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.
Source: ICANN / RFC 4033
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice