Security finding
A trust badge or certificate logo is expired, unlinked or cannot be checked
Security Warning Severity: Low
Part of the audit Security claims and security.txt that the site contradicts. Finding id: security.trustBadges.
What it costs you
A badge is a claim. One that the issuer does not confirm reads as a claim the site cannot back up.
What to do
Link the badge to a page of the issuer that confirms it, or take it off.
What it checks
- Trust badge expired or not linked
How to fix it
Renew it or remove the badge
- Ask whoever holds the certificate or membership whether it was renewed.
- If it was, replace the badge and its link with the current ones from the issuer.
- If it was not, take the badge off the page ([selector]).
How to check: Open the link of the badge on [page url]: the issuer's page confirms it for your organisation.
Link the badge to its verification page
- Get the verification address for your organisation from [issuer].
- Make the badge on [page url] a link to that address.
- If the issuer offers no such page, say in text next to the badge what it covers.
How to check: Open the link of the badge on [page url]: the issuer's page confirms it for your organisation.
A real case
The US Federal Trade Commission found that ControlScan issued security and privacy seals with little or no checking, while the seals showed a current date. Under the 2010 settlement the websites showing the seals had to take them down.
How to verify by hand
A person.
What this relies on
The claim was true when written.