HSTS (Strict-Transport-Security) is a security header sent by web servers instructing browsers to communicate exclusively over encrypted HTTPS connections for a specified duration (max-age). HSTS prevents SSL stripping attacks and cookie hijacking.

If visitors type `http://example.com`, your web server should issue an automatic HTTP 301 or 308 redirect to `https://example.com`. This ensures users never transmit sensitive data over unencrypted HTTP channels and preserves SEO link equity.

A hostname mismatch occurs when the domain name in the browser address bar does not match any Common Name (CN) or Subject Alternative Name (SAN) listed in the SSL certificate. Browsers trigger prominent security warnings when a hostname mismatch occurs.

Mixed content occurs when an initial HTML document is loaded securely over HTTPS, but sub-resources (images, scripts, stylesheets, or iframes) are loaded over unencrypted HTTP (`http://`). Browsers may block these insecure requests or degrade the padlock security status.

SSL certificates are issued by trusted Certificate Authorities (CAs) such as Let's Encrypt, DigiCert, Sectigo, or Cloudflare. Browsers maintain pre-trusted root CA lists; if a certificate is self-signed or issued by an untrusted CA, browsers display untrusted certificate warnings.

An online SSL probe performs an external TLS handshake and HTTP header inspection from our diagnostic server. It cannot audit internal private cipher suites, client certificate authentication, or custom operating system trust stores. It provides accurate real-time guidance rather than a complete enterprise security audit.