Skip to the content

Free security headers check

SSL Certificate and HTTPS Checker

A trusted certificate is only part of HTTPS. Check that the handshake succeeds, that http redirects to https, that HSTS keeps browsers on https and that no resource is loaded insecurely.

Check HTTPS

Enter a site. The handshake, the redirect and the page resources are checked.

Runs 5 checks. A bare domain works, https:// is added for you.

Checks in this tool:sec.tls-certificatecrawl.httpssec.hstssec.mixed-contentcrawl.host-canonical

Why use the SSL and HTTPS Checker

Certificate trusted

The TLS handshake must succeed with a trusted chain and a certificate that matches the hostname.

Redirect to HTTPS

The http version is requested to confirm it redirects to https.

HSTS

Strict-Transport-Security keeps returning visitors on https without the redirect.

Mixed content

Scripts, styles and images loaded over http from an https page are listed.

When to use the SSL and HTTPS Checker

Certificate renewals

Confirm the new certificate is served everywhere after a renewal.

New domains

Check HTTPS before pointing traffic at a new domain.

Browser warnings

Find the mixed content behind a not secure warning.

Subdomains

Each subdomain needs its own valid certificate.

CDN setup

Make sure the edge certificate covers both www and the bare domain.

Compliance

Show that all traffic is encrypted, with evidence.

Understanding SSL and HTTPS

What the certificate check proves

A successful TLS handshake from a standard client proves the chain is trusted, the certificate is currently valid and it matches the hostname. The audit runtime does not expose the certificate itself, so the number of days until expiry is not reported. Set up renewal alerts with your certificate provider.

A complete HTTPS setup

  1. 1Valid certificate. For every hostname that serves pages, www and bare.
  2. 2Permanent redirect. Every http url answers with a 301 or 308 to its https version.
  3. 3HSTS. A Strict-Transport-Security header with a max-age of at least six months.
  4. 4No mixed content. Every resource is loaded over https.

HSTS preload

Browsers ship a list of domains that are HTTPS only from the very first visit. To join it, send HSTS with includeSubDomains, preload and a max-age of at least a year, and submit the domain at hstspreload.org. Only do it when every subdomain supports HTTPS.

Privacy, safety and limits

The site is requested by AbackAuditBot over the standard ports. Only GET and HEAD requests are sent.

Related tools and guides

Security Headers CheckerSecurity headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.Redirect CheckerFollow every redirect of an address, hop by hop. Find chains that slow crawlers down, loops that break pages, and host variants that split your signals across duplicates.Security Headers GeneratorChoose the headers and their values, pick your platform, and copy a configuration for Nginx, Apache, Cloudflare, Netlify or Vercel.Canonical CheckerThe canonical link tells search engines which url is the real one when several show the same content. Check that it exists, that it is absolute and that it points at a working page.SEO CheckerFind the technical problems that keep a page out of search results. The checker reads the page the way a search crawler does and lists what to fix first, with the evidence behind every verdict.Page Speed TestMeasure how fast a page answers and renders on a throttled mobile profile, and find the causes: heavy pages, missing compression, uncached assets and render blocking scripts.Guide: Security headers guideThe HTTP security headers every website should send, what each one protects against, safe values to start with, and how to roll out a Content-Security-Policy without breaking the site.

Frequently asked questions

Does it show the certificate expiry date?

No. The audit runs in a runtime that verifies the handshake but does not expose the certificate details. A passing result means the certificate is valid today.

What causes a not secure warning on an https page?

Usually mixed content: an image, script or style loaded over http. The checker lists them.

Is a free certificate as good as a paid one?

For encryption, yes. Let's Encrypt and CDN certificates are trusted by every browser. Paid certificates add support and warranties, not stronger encryption.

Should www have its own certificate?

It needs to be covered, either by its own certificate or by one that lists both names.

What is HSTS?

A header that tells browsers to use https for the domain for a set time, even if someone types http.

Does HTTPS help rankings?

It is a light ranking signal. It matters more for trust, for browser warnings and because many browser features require it.

Can I check an internal site?

No. Private and internal addresses are refused for safety.

↑ ↓ to move↵ to openesc to close