Security Test: Frontend SSL enforced¶

Description¶

Default Severity: medium

When you let a connection start with plain HTTP instead of forcing HTTPS from the beginning, you open up a gap where attackers can intercept and potentially modify data before it becomes secure. This creates a risk where sensitive information can be exposed or tampered with, leading to data misuse, loss of trust, and even penalties from search engines. Many developers mistakenly rely on measures that only secure the connection after it's already been established, which leaves that initial link open to man-in-the-middle attacks. The key takeaway is ensuring every connection is encrypted from the start to prevent these vulnerabilities.

Reference:

• https://developers.google.com/search/docs/advanced/security/https

Configuration¶

Identifier: frontend_protocol/ssl

Examples¶

All configuration available:

checks:
  frontend_protocol/ssl:
    skip: false # default

Compliance and Standards¶