Confirm a site answers over HTTPS with a certificate we trust, see how it redirects, and read back the security headers that actually do something.
A trusted certificate on the website says nothing about the mail. They are separate systems, and only one of them decides whether your invoices reach the inbox.
That the site answers over TLS with a valid certificate, how it redirects, and which security headers it sends.
HTTP Strict Transport Security. A header that forces browsers to use HTTPS for your site, preventing downgrade attacks.