Skip to content

Basics

My certificate does not cover www

Anyone who reaches the uncovered hostname — from an old link, a typed URL or a printed address — gets a certificate warning before the redirect can run. The redirect cannot help, because the TLS handshake fails first.

What 13x checks

This is rule basics.certificate-hosts in the public registry: Certificate covers apex and www. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Basics
Score weight
6 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

The certificate does not cover .

The TLS handshake happens before any redirect, so a redirect cannot rescue this — the visitor sees a full-page warning first.

- Managed host: add the missing hostname as a domain in the project settings. Vercel and Netlify then reissue automatically covering both. Add the apex and www, and set one as primary with the other redirecting. - Certbot: include every hostname in one certificate:

bash code
sudo certbot --nginx -d example.com -d www.example.com

Note that a wildcard *.example.com does not cover the apex example.com — that is the most common version of this mistake. Both have to be listed.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More basics checks