Free check

Security headers and SSL check

This free check reads the response headers your page sends, the HTTPS setup and the TLS certificate, and reports missing security headers, an expiring certificate and outdated TLS, with no signup and nothing stored.

What the security row looks at

The row combines three things: whether the page is served over HTTPS, the TLS certificate and protocol version, and the security-related response headers of the page.

Whether the page is served over HTTPS at all
A certificate that has expired or expires within 30 days
TLS 1.0 or 1.1 in use instead of TLS 1.2 or newer
Strict-Transport-Security with a max-age of at least six months, and includeSubDomains
A Content-Security-Policy, X-Content-Type-Options and clickjacking protection
A Referrer-Policy and a Permissions-Policy
A Server header that leaks a version number, or an X-Powered-By header

Rule ids:no_httpscert_expiredcert_expiringtls_outdatedhsts_presenthsts_subdomainscsp_presentx_content_type_optionsframe_protectionreferrer_policypermissions_policyno_server_versionno_x_powered_by

Why it matters

Security headers are instructions to the browser, and they cost almost nothing to send. HSTS stops a browser from being downgraded to plain http. A Content-Security-Policy limits which scripts may run, which is the main defence against injected code. Clickjacking protection stops other sites from framing yours. An expired certificate is more immediate: browsers show a full-page warning and most visitors leave.

What a fix usually looks like

Headers are set in one place, your web server, CDN or hosting settings, so a single change applies to every page.

Redirect all http traffic to https and send Strict-Transport-Security
Send X-Content-Type-Options: nosniff
Set X-Frame-Options or a CSP frame-ancestors directive
Start the Content-Security-Policy in report-only mode, then tighten it
Automate certificate renewal so it never reaches the warning window
Strip version numbers from the Server header and remove X-Powered-By

What this check does not do

It reads headers and certificate details from one request. It is not a penetration test, does not scan for vulnerabilities in your code and does not probe other ports or services.

Frequently asked questions

What is the most important security header?

Strict-Transport-Security is the one the check treats as critical when it is missing or too short, because without it browsers can be downgraded to http. The Content-Security-Policy is the most effective against injected scripts but takes more care to roll out.

Does the check scan for vulnerabilities?

No. It reads the headers and certificate your site already sends to every visitor. It does not attack or probe the site.

How soon is an expiring certificate flagged?

The row warns when the certificate has fewer than 30 days left and treats fewer than 14 days, or an expired certificate, as critical.