A site’s external LinkSignal is a score out of 100 for its outbound (external) links, and for the link-related health of the site itself, right now. This page covers how your own site serves HTTPS, the third of the checks made on the scanned site itself, once per scan, alongside your domain and your certificate. The whole metric is described on the LinkSignal hub.
This part of LinkSignal is built only from what this tool finds when it visits your site. It is not linked to any search engine or third-party score, and it is not a security audit. It answers two plain questions and reports a third.
What this part of your LinkSignal measures
- Does the secure version load? The scan requests https:// for your site and records whether it answered.
- Does http:// send visitors on to https://? The scan requests the plain address and records whether it ended up on the secure one.
- Is HSTS on? HSTS is a header that tells browsers to always use https:// for your site. It is recorded and shown, and it costs nothing.
How it is counted
The published rule is: 10 points if the secure version does not load, 3 if http:// does not send visitors on to https://. The most this part can take off is 10 points, once per scan.
| What was found | Points lost |
|---|---|
| The secure version does not load | 10 |
| It loads, but http:// does not send visitors to https:// | 3 |
| It loads and http:// redirects, with HSTS off | 0 |
| HSTS on or off, on its own | 0 |
The two costs are not added together. If the secure version does not load, that is the larger problem and is the only one charged. If a check could not be completed, nothing is charged for it: a timeout alone is not treated as evidence of a problem.
A worked example
A site whose secure version does not load loses 10 points and scores 90, which is Strong. A site that loads over https:// but leaves the plain address as it is loses 3 points and scores 97, which is Strong. A site with both in place and HSTS off scores 100, because HSTS is not scored.
How it appears in your report
- Your site step in the action plan: an HTTPS figure with one word, Strong, Good, No redirect or Problem, and a next step in plain words. Good means everything works and HSTS is the only thing missing.
- Your site panel in the Inventory: three rows, Served over HTTPS, http:// sends visitors to https:// and HSTS (browsers always use https://), each showing Yes or No, On or Off, or Not checked.
- How this is worked out, in the LinkSignal card: a row called HTTPS on your site, with what was found and the points lost.
How to get the points back
- Make the secure version loadIf https:// fails, the cause is almost always the certificate: expired, missing or not matching the name. Fix that first, using your certificate.
- Add the redirectSet the server or host to send every http:// request to the same address on https:// with a permanent redirect. Most hosts have a single switch for it.
- Add HSTS, once the above worksAdd a Strict-Transport-Security header. Start with a short lifetime and lengthen it once nothing breaks, since browsers remember it. It does not change the score, but it closes the small window before the redirect takes effect.
- RescanRun a new scan and compare it with the last one using rescan and compare.
What it does not mean
- It does not judge the quality of your encryption settings.
- It does not say your pages are free of insecure content. A page can load over https:// and still link to http:// resources, which is a different question.
- A strong result is not a statement about your outbound links, which are scored in the other parts of the metric.
Questions
Why does HSTS cost nothing?
Its absence is not a failure on its own, and turning it on carelessly can lock visitors out. It is shown so it can be done on purpose.
My site works in my browser. Why does the report say the secure version did not load?
The scan makes a verified request, so a certificate problem that a browser or a cache has smoothed over for you still counts. Check the certificate first.
Why did it say Not checked?
The scan could not complete that request, so it is left out rather than guessed.
Run a scan and the three checks are in the report, under Your site.
