HTTPS and web security check: two complementary layers of protection
HTTPS protects traffic in transit. A web security check adds an assessment of code, access permissions, data processing and server configuration.
What HTTPS does
HTTPS uses TLS to encrypt the connection between browser and server and to link the server identity to a domain via a certificate. That helps against eavesdropping and manipulation in transit.
What an additional web security check assesses
In addition to the secure connection, we examine how your application handles accounts, forms, files, APIs, and personal data.
- Separation of data between different users.
- Security of dependencies and publicly accessible routes.
- Appropriate retention periods for personal data.
- Protection of admin accounts and sessions.
- Resilience of payment and ordering processes.
Visible and verifiable evidence
C9 Verified makes a broader assessment with a defined validity period visible. Visitors see which domain completed the full fixed audit framework, when the retest took place and how long the certificate is valid.
A new check can assess changes
TLS certificates, audits, and web security certificates complement each other. New code, configuration, and attack methods can make a reinspection worthwhile. The owner receives one reminder after eleven months; a new audit begins only after a new assignment.
Sources and further information
From knowledge to action: This general technical information helps you prepare. Our full security and GDPR privacy audit applies the fixed control framework concretely to your own website.