Practical Security Guides For Your Team

Your website is using a security certificate that you issued yourself, rather than one verified by a trusted third party. Think of it like a business putting up its own 'health and safety approved' sign instead of getting an official inspection — visitors and browsers have no way to confirm the certificate is genuine. Modern browsers will show a security warning to anyone who visits, which can drive customers away.

Your website's security certificate has expired. This certificate is what tells browsers your site is safe and keeps data encrypted between your site and your visitors. Right now, anyone visiting your site is likely seeing a full-screen warning saying 'Your connection is not private' — and most people will leave immediately rather than click through.

Your server's SSH service — the secure tunnel used for remote administration — is configured with encryption options that have a known flaw. An attacker positioned between your server and a connecting administrator (for example, on the same network) could quietly weaken that tunnel during the initial handshake, potentially stripping away some security protections before either side notices. Think of it like a tampered lock that looks fine from the outside but is slightly easier to pick.

Your website can be visited over plain HTTP (unencrypted), and it doesn't automatically send visitors to the secure HTTPS version. Any user who lands on an HTTP link — from an old email, a bookmark, or a mistyped URL — will have their connection left unprotected. Think of it like a shop that has a secure back entrance but leaves the front door unlocked with no sign pointing visitors to the right way in.

Your website is missing a small but important instruction it should send to browsers — one that tells them to always use a secure, encrypted connection. Without it, browsers may occasionally connect over an unencrypted channel, and there is no browser-level safeguard to prevent that from happening. Think of it like a lock on your front door: your HTTPS certificate is the lock, but this header is the sign that tells visitors to always use the locked entrance.