Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.CIPv6 ReadinessActionNo IPv6 supportREVIEW
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.
Source: Google IPv6 stats
BURL Variantswww/non-www, trailing slash, HTTP→HTTPSREVIEW
www / non-www
Inconsistent — duplicate content risk
HTTP → HTTPS
Consistent
CTLS Certificate Expiry & RecommendationsAction20 days until leaf cert expires — 4 issues to addressREVIEW
Certificate validity
Recommended actions
- Renew certificate — 20 days remaining
- Submit your domain to hstspreload.org to be added to the Chrome preload list
- Enable DNSSEC on your domain for DNS spoofing protection
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+DNS Records2 A records, 13 ms lookupPASS
| A | 104.18.90.237, 104.18.89.237 |
| AAAA | — |
| CNAME | — |
| NS | fay.ns.cloudflare.com, jim.ns.cloudflare.com |
| MX | 1 aspmx.l.google.com 5 alt2.aspmx.l.google.com 5 alt1.aspmx.l.google.com 10 aspmx3.googlemail.com |
| TXT | 16359333 Dynatrace-site-verification=10887f73-4311-4a4b-83e3-312614aeb532__h68in82ubsmc8a... MS=6100C439A4691C31E2EC1342F09C3607B3B64DAC MS=ms47394909 _6lgpbootvod9h9mgfdn7efsdz52nzx0 _vmdb9wrav5ukmzhtyzh5cps8gs2zooy adobe-idp-site-verification=45e831bcd7ad9667a0be62ad1db9971caa65d4c68af84b32f30c... anthropic-domain-verification-a50qdm=eDDAJvU3hKqefx59gXmsODCgG asv=54832828144bb4ff89f152511204f3e2 asv=a52d93b02babfa60a71bdd4128a06b39 atlassian-domain-verification=DoYMWjavpCmTKuGBom3ae2z5MjboF/gvCunpO0e1m8n9S5D5Uk... bugcrowd-verification=dae371187bf32cac11a23664ea291f6c chariot=chariot+upwork@praetorian.com cursor-domain-verification-z00fy8=8sg38uSSHGnTzRvM2sEDPoIl3 docker-verification=ccc1198a-92ef-4bca-8e5c-896b7c508065 docusign=277af459-13d2-4b85-bb45-53efc4b671f6 facebook-domain-verification=8nwzxhaovba8tj7d2ldml1bhssa1pm google-site-verification=-LgXVF8adhy30B1kiNabPgT-Pymy3WZOOvfGFgp6XGE google-site-verification=3jXROOXzwXZqaI-z95yNNpu9L8mSRW3Jd5VCpjVOxwk google-site-verification=4g4BiPppYs75ob9yO422K5BqFPttTmPK_fmNtaopAI8 google-site-verification=4p2pqAQ0yiDL2lc81zb89ZA-Wt6u9uBY25QEMjp-b4s google-site-verification=BkuVDFrIY09DX823uWROsYHLrLeCUKJ366m1k4AmoT4 google-site-verification=LSicnKkde4b1FmPqfr0FX6l7R4VvjAxTVzZP0sebXKk google-site-verification=MFfOuTSDuMVfAuZmNHfYJA16r0P_BeZX5F60NQnSHNA google-site-verification=MK7qfjAI4BOyhzOcaFe2WjFleaX2gKcUUu6VKf5X-qE google-site-verification=PkziJTcGbOV4cv301PZ8KfBzni-MN_cB3J4ngmLA9Ps google-site-verification=f3f7WfTf8cecTKAI3cwfnA-cmQP1WlyDMfzuzG6BB-8 google-site-verification=hJI07_9hhjkWQFySSiVg5v3vNIpZBMwOkA1Il7-tCMY google-site-verification=sD8rL1N3j5vS_miQGy_NwdmJHTmFUU42SDhYa4rdQ84 google-site-verification=zTEmbU71ZrIPR7JRRlWSGiQurNYft76eEdSdP6aAQkQ hcp-domain-verification=b36955e77a08570a83deddbbdfa15fe1894a5c747597bc9941fc15f6... jamf-site-verification=GjhSBwax0Pxacxf38XbNHw linear-domain-verification=z536v5rd3xih liveramp-site-verification=qn4k0EIcwgkwW6N80DcWp-G_gQeo9SCk4fdGh21URyw logmein-domain-confirmation 2141230743 miro-verification=6a8362f817d4ea530843a04d46c6418e011c951d mixpanel-domain-verify=2a906114-e222-4323-bbd7-0a671f9d90ee mongodb-site-verification=xc3WGhQz20Yw7Lm6yMoC6L4b5gf08icW nlmdbpv52ts89j835vzt3c71d201hqk5 openai-domain-verification=dv-0pTGTkARXsArFAKKZwc6Fzbl paloaltonetworks-site-verification=e10a924e19c474e2b83aa85600a8d52fb39615b7834f9... sjlh98brgm4j879mz0km0f9kz0s61mf8 stripe-verification=E9104449B2742089788253DB69E0E9C226D3F54E519514A3698526A4594B... SPF v=spf1 include:upwork.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf... zapier-domain-verification-challenge=0ab7c0ae-a354-49d6-9012-16a12e53b121 |
| CAA | Lookup not available with standard resolver |
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
ARedirect Chain1 redirect(s), 377 ms totalPASS
https://upwork.com
60 ms · HTTP/1.1
https://www.upwork.com/
317 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://upwork.com | 301 | 60 ms | HTTP/1.1 | cloudflare |
| 2 | https://www.upwork.com/ | 200 | 317 ms | HTTP/1.1 | cloudflare |
See the visual redirect chain in the HTTP Probe tab →
ACrawlabilityrobots.txt present, no sitemapPASS
A sitemap helps search engines discover and index your pages more efficiently.
No sitemap.xml — Google relies on crawl-graph discovery alone, slowing indexing of deep or fresh URLs.
Learn more ▾ ▴
A sitemap accelerates Google's discovery of new and updated content. Most CMSes auto-generate one; static-site frameworks need a build-step plugin. Reference it from robots.txt and submit in Search Console to confirm Google can fetch it.
Source: sitemaps.org / Google Search Central
User-agent: *
# Sitemaps
Sitemap: https://www.upwork.com/sitemap.xml
# LLMs: https://www.upwork.com/llms.txt
# Directories
Disallow: /att/
Disallow: /att-old/
Disallow: /freelancers/public/api/
Disallow: /messages/
Disallow: /*/jobs/search*
Disallow: /search/profiles/*
Disallow: /catalog-images/*
Disallow: /ab/
Disallow: /hire/de/sem/
Disallow: /nx/
# Files
Disallow: /j/view_opening_popup.php
Disallow: /leaving_odesk.php
Disallow: /leaving-odesk
Disallow: /leaving
Disallow: /nx/top-nav-ssi/visitor-gql-token
# Paths (clean URLs)
Disallow: /rss/
Disallow: /atom/
Disallow: /jobs/rss
Disallow: /jobs/atom
Disallow: /jobs/*?source=rss
Disallow: /upi/metrics/rum/v1
Disallow: /upi/jslogger
Disallow: /nx/top-nav-ssi/visitor-gql-token
Allow: /ab/account-security/reset-password
Allow: /ab/downloads
Allow: /ab/g/pub/wom/prx/
Allow: /ab/g/pub/wom/bnr/
Allow: /nx/signup/
# Exclude blog search
Disallow: /*/wp-content/cache/
Disallow: /*/trackback/
Disallow: /*/feed/
Disallow: /*/comments/
Disallow: /blog/?s=*
Disallow: /hiring/?s=*
Disallow: /hiring/?seo-skill-pages=*
Disallow: /press/?s=*
Disallow: /blog/ajax-api/
Disallow: /hiring/ajax-api/
Disallow: /nx/signup/?accountType
Disallow: /nx/signup/?clRedirectTo
Disallow: /nx/signup/?dest
Disallow: /nx/signup/?midTier
Disallow: /nx/signup/?portal
Disallow: /nx/signup/?redir
Disallow: /nx/signup/?signupType
Disallow: */login*?*
Disallow: */signup*?*
Disallow: /signup/contact-contractor/id/*
Disallow: /signup/view-profile/id/*
Disallow: /signup/please-verify*
Disallow: /offers/?job*
Disallow: /job/*/apply/$
Disallow: /b/signup/create-account/client_contact_freelancer
Disallow: /b/signup/create-account/freelancer_apply_job
Disallow: /freelance-jobs/fiction-writing/
Disallow: /ab/account-security/login?
Disallow: /api*
# Exclude referrals URLs
Disallow: /referrals*
# Exclude Job Search noindex URLs
Disallow: /o/jobs/browse/*?*client_hires=*
Disallow: /o/jobs/browse/*?*duration=*
Disallow: /o/jobs/browse/*?*workload=*
Disallow: /o/jobs/browse/*?*sort=*
Disallow: /o/jobs/browse/api/sands-suggestions*
Disallow: /o/jobs/job/*
# Exclude Vega Job Search URLs for now
Disallow: /r/
# Exclude Registration Success page
Disallow: /signup/registration-success*
# Exclude temporary Vega Job Details URLs
Disallow: /c/o/jobs/job/
# Exclude Vega Profiles Search new parameters
Disallow: /o/profiles/browse*?*exp=*
Disallow: /o/profiles/browse*?*loc=*
Disallow: /o/profiles/browse*?*rhrs=*
Disallow: /o/profiles/browse*?*rate=*
Disallow: /o/profiles/browse*?*tests=*
Disallow: /o/profiles/browse*?*tests_10=*
Disallow: /o/profiles/browse*?*last=*
Disallow: /o/profiles/browse*?*pt=*
Disallow: /o/profiles/browse*?*english=*
Disallow: /o/profiles/browse*?*lang=*
Disallow: /o/profiles/browse*?*local_hiring=*
Disallow: /o/profiles/browse*?*revenue=*
Disallow: /o/profiles/browse*?*user_pref=*
Disallow: /o/profiles/browse/api/freelancer-search-facet/
# Excluded agencies
Disallow: /o/companies/~0180c6b44423eeda59
# Nuxt testing app
Disallow: /ab/cat/*
# Block old static routes
Disallow: /i/js/*
Disallow: /i/css/*
Disallow: /i/images/*
Disallow: /i/wd/*
Disallow: /i/wdj/*
Disallow: /i/p/*
Disallow: /i/trends/*
Disallow: /i/wp-login.php
Disallow: /i/related_users/*
Disallow: /i/smr/*
Disallow: /i/img/*
Disallow: /l/cn/data-analysts-in-beijing/js/*
Disallow: /l/cn/data-analysts-in-beijing/css/*
Disallow: /jobs/
Disallow: /track/
# Block RSS/Atom feeds
Disallow: /ab/feed/
# Block UPI pages
Disallow: /upi/jslogger
Disallow: /upi/metrics/rum
Disallow: /upi/psmetrics
# -------------------------------
# ---------START ME-2650---------
# -------------------------------
# Tracking / attribution
Disallow: /*?utm_*
Disallow: /*?gclid=*
Disallow: /*?gad_source=*
Disallow: /*?sem=*
Disallow: /*?trk=*
Disallow: /*?promobnr=*
Disallow: /*?promo=*
Disallow: /*?channel=*
Disallow: /*?mp_source=*
Disallow: /*?redir=*
Disallow: /*?ref=*
Disallow: /*?referrer_url_path=*
Disallow: /*?share=*
Disallow: /*?a=*
Disallow: /*?p=*
Disallow: /*?name=*
Disallow: /*?image=*
Disallow: /*?track=*
# Navigation / pagination / session noise
Disallow: /*?page=*
Disallow: /*?items_per_page=*
Disallow: /*?order=*
Disallow: /*?sort=*
Disallow: /*?nav_dir=*
Disallow: /*?viewmode=*
Disallow: /*?device-view=*
Disallow: /*?dfh_uid=*
Disallow: /*?dm_to_uid=*
Disallow: /*?s=*
# Signup / verification and related params
Disallow: /*?accountType=*
Disallow: /*?portal=*
Disallow: /*?dest=*
Disallow: /*?reg-success=*
Disallow: /*?frkscc=*
Disallow: /nx/signup/verify-email/*
Disallow: /nx/signup/verify-phone*
# Jobs / job board
Disallow: /*?gh_jid=*
Disallow: /*?loc=*
# Attachment / bot noise
Disallow: /*?attachment-id=*
Disallow: /*?_pxhc=*
Disallow: /*?ff_UPL635ChatPro=*
# Facets / filters (scoped to services to avoid over-blocking)
Disallow: /services/*?all=*
Disallow: /services/*?start=*
Disallow: /services/*?cat=*
Disallow: /services/*?price_range=*
Disallow: /services/*?talent_quality=*
Disallow: /services/*?spec_choice=*
# -------------------------------
# ----------END ME-2650----------
# -------------------------------
# -------------------------------
# ---------START ME-2888---------
# -------------------------------
# Ad platform click IDs
Disallow: /*?fbclid=*
Disallow: /*?msclkid=*
Disallow: /*?ttclid=*
Disallow: /*?qclid=*
Disallow: /*?yclid=*
# Campaign / partner / promo tracking
Disallow: /*?vt_cmp=*
Disallow: /*?mf_ct_campaign=*
Disallow: /*?partner_code=*
Disallow: /*?promo_code=*
# Pagination / view variants
Disallow: /*?*_page=*
Disallow: /*?offset=*
Disallow: /*?view=*
Disallow: /*?page_variant=*
Disallow: /*?toc-variant-*
Disallow: /*?navPos=*
# Session / request IDs
Disallow: /*?sid=*
Disallow: /*?rid=*
Disallow: /*?kuid=*
Disallow: /*?ssrid=*
# Shortlinks and malformed query strings
Disallow: /*?shortlink*
Disallow: /*?!*
Disallow: /*?&*
# Internal framework / redirect params
Disallow: /*?_rsc=*
Disallow: /*?_redirected=*
# Google Analytics cross-domain linker params
Disallow: /*?_ga=*
Disallow: /*?_gl=*
# -------------------------------
# ----------END ME-2888----------
# -------------------------------
# -------------------------------
# ---------START ME-3153---------
# -------------------------------
# Product / profile / org context (avoid duplicate indexable URLs)
Disallow: /*?nbs=
Disallow: /*?viewMode=
Disallow: /*?companyReference=
Disallow: /*?companyreference=
Disallow: /*?client_id=
Disallow: /*?wom=
Disallow: /*?pin=
Disallow: /*?english_level=
Disallow: /*?landing_url=
Disallow: /*?via=
Disallow: /*?org=
Disallow: /*?category=
Disallow: /*?tot=
Disallow: /*?tab=
Disallow: /*?t=
Disallow: /*?preventDismiss=
Disallow: /*?wtime=
Disallow: /*?referral=
Disallow: /*?wsrc=
Disallow: /*?step=
Disallow: /*?id=
Disallow: /*?title=
Disallow: /*?qpn-profile-completeness=
Disallow: /*?create-service-profile=
Disallow: /*?deleted-project-uid=
Disallow: /*?weekdayJdUid=
Disallow: /*?location=
Disallow: /*?pageTitle=
Disallow: /*?mbp-open=
Disallow: /*?forceEditor=
Disallow: /*?lor=
Disallow: /*?regv1=
Disallow: /*?openModal=
Disallow: /*?modal=
Disallow: /*?flow=
Disallow: /*?mpSource=
Disallow: /*?type=
Disallow: /*?section=
Disallow: /*?ee=
Disallow: /*?web=
Disallow: /*?uni=
Disallow: /*?euidtkncn=
Disallow: /*?os=
# Search / navigation / generic query noise
Disallow: /*?query=
Disallow: /*?link_search=
Disallow: /*?q=
Disallow: /*?source=
# Affiliate / paid / partner attribution
Disallow: /*?irclickid=
Disallow: /*?srsltid=
Disallow: /*?gh_src=
Disallow: /*?fpr=
Disallow: /*?partnerId=
Disallow: /*?campaignid=
Disallow: /*?campaign=
Disallow: /*?ppc=
Disallow: /*?afsrc=
Disallow: /*?irgwc=
Disallow: /*?gc_id=
Disallow: /*?bp-pevc-promocode=
Disallow: /*?_kx=
# Third-party widgets / reviews / share / app deep links
Disallow: /*?speechify_reviews=
Disallow: /*?product_studio_contact=
Disallow: /*?open-share=
Disallow: /*?mobile-app=
# Bot / challenge / CDN (Cloudflare)
Disallow: /*?__cf_chl_tk=
# Marketing automation / email / analytics IDs
Disallow: /*?__hstc=
Disallow: /*?_hsenc=
Disallow: /*?hsFormKey=
Disallow: /*?hsPreviewerApp=
Disallow: /*?hsSkipCache=
Disallow: /*?mc_cid=
Disallow: /*?itcat=
Disallow: /*?roistat_visit=
Disallow: /*?atr=
Disallow: /*?ajs_aid=
Disallow: /*?psafe_param=
Disallow: /*?requestId=
# CMS preview / versioning / WordPress ecosystem noise
Disallow: /*?ver=
Disallow: /*?preview_id=
Disallow: /*?elementor-preview=
# E-commerce / checkout / promos (third-party or legacy flows)
Disallow: /*?xcod=
Disallow: /*?pStoreID=
Disallow: /*?brand_id=
Disallow: /*?cdConvenio=
Disallow: /*?cartflows_flow=
Disallow: /*?Access_Code=
Disallow: /*?kclt=
Disallow: /*?ciphertext=
Disallow: /*?lessDeposite=
# Geo / locale variants
Disallow: /*?IDDrzava=
# -------------------------------
# ----------END ME-3153----------
# -------------------------------
# Block Wayback Machine
User-agent: ia_archiver
Allow: /legal/
Disallow: /
User-agent: Linespider
Disallow: /
User-agent: PetalBot
Disallow: /
User-agent: proximic
Disallow: /
No sitemap found
Adding a sitemap helps search engines discover your pages.
A+Domain Intelligenceupwork.com — via MarkMonitor Inc., 24 years, 6 months old, hosted on CloudflarePASS
565 days
January 30, 2028
20 days
Issued by DigiCert Inc
24 years, 6 months
Registered January 30, 2002
Not enabled
Protects against DNS spoofing
Cloudflare
ASN AS13335
104.18.89.237
MarkMonitor Inc.
Expiry timeline
Recommended actions
- Renew the TLS certificate or verify auto-renewal is working
- Enable DNSSEC to protect visitors from DNS spoofing
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.
Learn more ▾ ▴
DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.
Source: ICANN / RFC 4033
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice