SSL & HTTPS check

Is your HTTPS actually set up right?

A padlock isn’t the whole story. Check the certificate, its expiry, the TLS version, the redirect from HTTP and HSTS, plus insecure content that quietly breaks the padlock.

Passive scan. Nothing is attacked without your permission.

What we check

Whether the site loads over HTTPS at all, and whether http:// redirects to https://.
Certificate trust and the days left before it expires.
Outdated TLS versions (TLS 1.0 and 1.1 are deprecated by RFC 8996).
HSTS presence and max-age.
Mixed content: scripts, images or styles still loaded over plain HTTP.

Certificates are getting shorter-lived

Public TLS certificates are moving to much shorter lifetimes, which makes automatic renewal essential. If you use Let’s Encrypt with certbot, test renewal now:

shell

sudo certbot renew --dry-run

Redirect and mixed-content fixes are in the HTTPS guide.

Need a deeper TLS audit?

Verified owners get a full protocol and cipher review in the deep scan. For a one-off deep dive into TLS alone, Qualys SSL Labs is the reference tool, and we recommend it.

Frequently asked questions

How do I know when my SSL certificate expires?

Run the free scan: it shows the number of days left and flags certificates that are close to expiring. A free account re-checks monthly.

Why is my padlock missing even though I have a certificate?

Usually mixed content: something on the page, often an image or script, still loads over http://. The scan lists it so you can fix the URL.

Should I enable HSTS?

Yes, once every page and subdomain you use works over HTTPS. Start with a short max-age and raise it to one year once you’re confident.

Guides with copy-paste fixes

Guide

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.