Overview
Findings
Actions
Details
Related
LynxRadar → Directory → gov.uk
A
95 / 100

gov.uk

Security report · Scanned February 15, 2026

Checks
8
Passed
7
Warnings
1
Critical
0
AI-Generated Summary
What this means

gov.uk scored 95/100, demonstrating a strong security posture. Minor improvements are noted below.

Positive signals: TLS Configuration, DMARC / Email Security, Known Breaches all passed.

1 action item identified, including 0 critical. The issues are configuration gaps, not architectural problems. A focused remediation effort of 2–5 days could address all findings.

How gov.uk compares

Grade distribution across 2598 companies we've scanned. gov.uk scores better than 96% of them.

96th percentile
0 Percentile rank 100
83
A+
25
A
190
A-
196
B+
75
B
362
B-
129
C+
114
C
330
C-
119
D+
95
D
252
D-
628
F
gov.uk — Grade A (95/100) 2598 companies scanned
Security checks

Each check inspects a different part of gov.uk's public security setup. Green means healthy, yellow needs attention, red is a problem.

Certificate Hygiene
Strengths: Certificate valid, 316 days remaining; Issued by GlobalSign nv-sa. Issues: Wildcard certificate in use — broader attack surface if compromised.
Needs work
TLS Configuration
TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
Healthy
DMARC / Email Security
Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: default, google, selector1, selector2, s1, s2, k1, dkim, mail).
Healthy
Known Breaches
No known breaches found in public disclosure databases.
Healthy
DNS Configuration
Strengths: 8 nameservers configured (nsc.nic.uk., dns4.nic.uk., nsb.nic.uk., dns2.nic.uk.); DNSSEC enabled; Zone transfers properly restricted.
Healthy
HSTS Header
HSTS enabled: max-age=31536000. Missing includeSubDomains. preload present.
Healthy
Security Headers
All 5 recommended security headers present: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
Healthy
CVE Exposure
Detected technologies: nginx, Proxy/CDN. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). No version information exposed — CVE matching not possible (this is good practice).
Healthy
Recommended actions
1 item

Steps to improve gov.uk's security grade, ranked by impact.

1
Review certificate configuration
Impact: 1–2 Hours
LOW
Certificate issues found for gov.uk: wildcard certificate in use. Wildcard certificates have a broader blast radius if compromised. These are operational hygiene items, not immediate security risks.
How to fix this
1
Consider replacing wildcard cert with individual certs for critical subdomains
2
Consolidate certificate issuance to 1–2 trusted CAs
At a glance

Key data points from the scan.

TLS Version
TLSv1.3
TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
DMARC Policy
p=reject
Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: default, google, selector1, selector2, s1, s2, k1, dkim, mail).
SPF Record
Present
v=spf1 -all
Security Headers
5/5 present
All headers configured.
HSTS
Enabled
HSTS enabled: max-age=31536000. Missing includeSubDomains. preload present.
SSL Certificate
Issues
Strengths: Certificate valid, 316 days remaining; Issued by GlobalSign nv-sa. Issues: Wildcard certificate in use — broader attack surface if compromised.
DNSSEC
Enabled
Strengths: 8 nameservers configured (nsc.nic.uk., dns4.nic.uk., nsb.nic.uk., dns2.nic.uk.); DNSSEC enabled; Zone transfers properly restricted.