Beyond the padlock: HTTPS and TLS.
What does encryption protect? A guide to TLS, HSTS and certificates.
What does HTTPS protect?
HTTPS carries HTTP traffic over TLS. It protects data in transit against reading and modification, while certificate verification checks the requested domain’s identity. An encrypted website can still serve harmful content. HTTPS alone does not guarantee a trustworthy business or accurate information.
TLS versions and connection endpoints
TLS 1.3 is used by modern connections, while TLS 1.2 can remain secure depending on configuration. Astrotor’s connection card describes the link between your browser and its Cloudflare endpoint. It does not describe another domain’s TLS version. Use the separate HTTPS checker to inspect a target website.
Are HSTS and redirects the same?
An HTTP-to-HTTPS redirect tells the browser to visit the secure address. HSTS tells it to use HTTPS for that domain for a defined period. The policy is received over a secure connection; first-visit behavior and preload status matter separately. A missing HSTS header does not by itself make an HTTPS connection insecure.
Interpret certificate logs carefully
Certificate Transparency logs can show certificates issued for a domain in the past. A logged certificate may not be the one currently served. Astrotor therefore separates live HTTPS results from optional certificate log data. If a check fails, investigate the connection and domain settings instead of assuming the target is secure.