A site’s external LinkSignal is a score out of 100 for its outbound (external) links, and for the link-related health of the site itself, right now. This page covers the part that reads the security certificate your own site presents. It sits with your domain and HTTPS as the three checks made on the scanned site itself, once per scan. The whole metric is described on the LinkSignal hub.
This part of LinkSignal comes only from this tool’s own findings. It is not linked to any search engine or third-party score, and PageRank plays no part in it. It reads a date from your certificate and applies a published rule.
What this part of your LinkSignal measures
A security certificate is what lets a browser open your site over https:// and show the padlock. Each scan connects to your site on the secure port, reads the certificate it presents, and records when it expires and whether browsers would trust it. Once a certificate has expired, visitors are met by a full-page warning before they reach the site, and most turn back.
How it is counted
The published rule is: 10 points if it has expired, 5 if it expires within 21 days. The warning window is 21 days, much shorter than for a domain, because certificates are renewed far more often. The most this part can take off is 10 points, once per scan.
| Days left on the certificate | Points lost |
|---|---|
| Already expired | 10 |
| Expires within 21 days | 5 |
| More than 21 days | 0 |
If the certificate cannot be read at all, nothing is scored and the report says it could not be read. A certificate that is not trusted by browsers is flagged in the report, and a site whose secure version fails to load is handled under HTTPS, where it costs points.
A worked example
A certificate with 9 days left loses 5 points, so a site with nothing else found scores 95, which is Strong. If the certificate expired two days ago, it loses 10 points and the site scores 90, which is Strong.
How it appears in your report
- Your site step in the action plan: a Certificate expires in figure, coloured once it is inside the window, with the action to renew the certificate (or to renew it now if it has expired).
- Your site panel in the Inventory: a Security certificate row with the date and days left, a Not trusted by browsers chip where that applies, or Couldn’t be read.
- How this is worked out, in the LinkSignal card: a row called Your security certificate with the days left and the points lost.
How to get the points back
- Renew the certificateRenew it with whoever issued it, or through your host. Many hosts and certificate authorities offer free certificates that renew themselves.
- Switch on automatic renewalIf renewal is automatic, check it is actually working. A certificate near expiry that should have renewed usually points to a broken renewal job, a changed DNS record or a moved server.
- Install it and check the chainA renewed certificate only helps once it is installed on the server your visitors reach, including any intermediate certificates. Load the site in a fresh browser to confirm there is no warning.
- RescanThe certificate is read again on every scan. Use rescan and compare to confirm the new date and the points returned.
What it does not mean
- It does not rate the strength or type of the certificate. It reads the date, and whether browsers trust it.
- It is not a verdict on the content of your site, and it says nothing about the sites you link to.
- A valid certificate does not mean the redirect to https:// and HSTS are in place. Those are separate, under HTTPS.
Questions
Why was my certificate flagged when it renews itself?
The scan reads the certificate the site presents at that moment. If it is inside the 21-day window, the automatic renewal has not happened yet, which is worth checking.
Does the certificate on my other subdomains count?
No. The certificate for the host that was scanned is the one that is read.
What does Not trusted by browsers mean?
The certificate does not chain to an authority browsers trust, or it does not match the site’s name. Visitors would see a warning even before the date.
Where do I learn about certificates in general?
The glossary entry for security certificate explains them in plain terms, and check your domain and certificate covers doing it by hand.
Run a scan and the certificate’s expiry is in the report, under Your site.
