gnu.org
Measuring…
gnu.org
Scanned:
76/ 100
Score by axis
Watch this site's security
We'll email you if its security slips — a new vulnerability, an expiring certificate, a blacklisting. No account needed.
Security alerts only — nothing else, and no email unless something is wrong. Unsubscribe anytime.
Want more than security alerts?
Coming soonMonitor — daily re-scans across all five axes, instant alerts on new and cert expiry, Telegram & web push, and full history.
Fix what matters first
- 1HTTPS & HTTP→HTTPS redirectHow to fix this →+5
Add a permanent (301) redirect from http:// to https://.
- 2+4
- 3Core Web Vitals (PageSpeed)+5
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
- 4+2
- 5HTTP/2 or HTTP/3+2
Enable HTTP/2 (and ideally HTTP/3) for faster delivery.
Recommendations are ranked by their impact on your score.
All checks
Security
70/ 100- Warn
HTTPS & HTTP→HTTPS redirect
HTTPS available, but HTTP does not redirect to HTTPS
Add a permanent (301) redirect from http:// to https://.
- Pass
TLS certificate validity
Valid; expires in 88 days
expires 2026-10-07 · YR2 - Pass
HSTS (Strict-Transport-Security)
Present
max-age=63072000 - Warn
Content-Security-Policy
No Content-Security-Policy header
Add a Content-Security-Policy to mitigate and injection.
- Warn
Core security headers
Missing: Referrer-Policy
Add the missing headers: Referrer-Policy.
- Pass
Mixed content (HTTP on HTTPS)
No insecure (http://) subresources
- Pass
SPF email anti-spoofing
record present
v=spf1 ip4:209.51.188.0/24 ip6:2001:470:142::/48 ip4:18.4.89.21 ip4:15.204.209.91 ip6:2604:2dc0:101:200::1d07 -all - Pass
DMARC email anti-spoofing
record present
v=DMARC1; p=none; rua=mailto:dmarc-rua@fsf.org - N/A
Vulnerable front-end libraries
No recognizable front-end library versions detected
Performance
65/ 100- Pass
Time to First Byte
30 ms
- Pass
Text compression
Enabled (gzip)
- Warn
HTTP/2 or HTTP/3
Only HTTP/1.1
Enable HTTP/2 (and ideally HTTP/3) for faster delivery.
- Pass
Cache-Control
max-age=0
- Warn
Core Web Vitals (PageSpeed)
perf 71/100, 2681ms, 0.00 (field)
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
SEO
74/ 100- Pass
Page title
The GNU Operating System and the Free Software Movement
- Pass
Meta description
152 characters
Since 1983, developing the free Unix style operating system GNU, so that computer users can have the freedom to share and improve the software they use. - Warn
Canonical URL
No canonical link
Add <link rel="canonical"> to avoid duplicate-content issues.
- Pass
- Pass
- Warn
Single H1
0 H1 tag(s)
Add exactly one <h1> describing the page.
- Pass
Image alt text
12/12 images have alt (100%)
- Warn
Structured data (JSON-LD)
No structured data
Add schema.org to enable rich results.
Infrastructure
100/ 100- N/A
CMS detection
No CMS fingerprint detected
- N/A
CMS known vulnerabilities
No CMS detected
- Pass
Web server
Apache
- N/A
CDN detection
No CDN fingerprint detected
- Pass
TLS version
TLS 1.3
- Pass
IPv6 (AAAA record)
AAAA record present
2001:470:142:5::116
Reputation
90/ 100- Pass
Google Safe Browsing
Not flagged
- Pass
Domain blacklist status
Not on major blocklists
checked: Spamhaus DBL, SURBL - N/A
Domain age
Registration date unavailable
- N/A
Domain expiry
Expiry date unavailable
Go deeper
This scan is passive. An attacker won't be.
The free scan reads what your site shows everyone. A Deep Audit does what an attacker does — it actively probes your verified site for what's really exposed.
This free scan (passive)
- Security score
- Known-CVE counts
- Security headers
- TLS & certificate
- Blacklist & Safe Browsing
Deep Audit — active scan of your verified site
- Per-CVE breakdown: IDs, severity, exploit availability, fix version
- Exposed files (.git, .env, backups)
- Directory listing
- Open admin panels
- Open ports
- Subdomain exposure
- Prioritized fix plan
- Full PDF report
What we can't check without your permission
These need active probing of your site: exposed .git/.env/backups, open admin panels, open ports, forgotten subdomains. Verify your domain and we'll show you what an attacker would find.
How it works
- Verify your domain — a file or DNS record, about 2 minutes.
- We actively scan it — a few minutes; we email you when it's ready.
- Get your full report + PDF.
The deep scan is live and free while we're in beta. Verify your domain and run it now.
Active checks run only on a domain you've verified as yours, with your consent. We detect — never exploit. Free in beta; $39 one-time after launch, no subscription — and early adopters keep the deep scan free.
Run a free deep scanShare this report
Get the badge
Embed this badge on your website — it links back to this full report.
<a href="https://chkweb.com/report/gnu.org"><img src="https://chkweb.com/badge/gnu.org.svg" alt="Website security checked by CheckWeb" /></a>