transport security Shipped
What this lens looks for
Require TLS 1.2 as the minimum and prefer TLS 1.3; TLS 1.0 and 1.1 must be disabled entirely. Enable HSTS on all production domains (Strict-Transport-Security: max-age=31536000; includeSubDomains; preload) and submit to the HSTS preload list. Use certificate pinning with caution: pin to the intermediate CA rather than the leaf, since leaf certificates rotate; it is acceptable for mobile apps but generally avoided for web (HPKP is deprecated); backup pins must be included along with a recovery plan; and consider Certificate Transparency monitoring as an alternative. For cipher suites, use Mozilla's "Intermediate" or "Modern" TLS configuration and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305).
What its verifier checks
TLS 1.2 is the enforced minimum with TLS 1.3 preferred, and TLS 1.0/1.1 are disabled; HSTS is enabled on production domains with max-age=31536000; includeSubDomains; preload and the domain is submitted to the preload list (no plain-HTTP endpoints); where certificate pinning is used, it pins to the intermediate CA rather than the leaf, includes backup pins and a recovery plan, is limited to mobile rather than web, and/or relies on Certificate Transparency monitoring; cipher suites follow Mozilla's Intermediate or Modern configuration and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305).