Website HTTPS Checker
Check everything that makes a site properly secure in one go. The checker loads the home page over HTTPS, verifies that the certificate is trusted, covers the host and is not about to expire, tests whether http:// redirects permanently to https://, reads the Strict-Transport-Security header and its max-age, includeSubDomains and preload flags, reports the negotiated TLS version and counts http:// resources on the home page. A weighted score sums it up.
- Encrypted connection
- No sign-up
- Free to use
How to use Website HTTPS Checker
- Enter the domain.
- Click “Check HTTPS”.
- Read the score and checks.
- Fix redirects, HSTS or certificate issues.
Website HTTPS Checker features
Certificate
Trust, names and expiry.
Redirect
http → https, permanent.
HSTS
max-age, subdomains, preload.
TLS version
Negotiated protocol.
Mixed content
On the home page.
Safe fetching
Public addresses only, with size and time limits.
When to use Website HTTPS Checker
- Launch checks.
- After moving to HTTPS.
- Certificate renewal monitoring.
- Security reviews.
Website HTTPS Checker FAQ
Why must http redirect to https?
Visitors who type the address without https would otherwise use an unencrypted connection.
What is HSTS?
A header that tells browsers to use HTTPS for the site for a set time, even if a link says http.
What max-age should HSTS have?
At least six months (15552000 seconds); one or two years for preload.
Should I use 301 or 302?
A permanent redirect – 301 or 308.
Why should the redirect be 301 rather than 302?
A permanent redirect tells browsers and search engines that https is the real address, so rankings and links consolidate on it. A temporary 302 does not.
How often should I renew my certificate?
Most certificates last 90 days or a year. Automatic renewal with an ACME client such as Certbot, or your host’s built-in renewal, avoids expiry.
Does HTTPS affect SEO?
Google uses HTTPS as a light ranking signal, and browsers mark plain http pages as not secure, which affects trust.
What a complete HTTPS setup needs
A certificate alone is not enough: without a redirect and HSTS, the first request can still go over plain HTTP. All three together make the connection reliably encrypted.
Automated renewal with an ACME client such as Certbot prevents expired certificates.
A properly secured site does more than answer on https. The checker verifies that the certificate is trusted, covers the host name and is not close to expiry, that http:// redirects permanently (301 or 308) to https://, and that the Strict-Transport-Security header is present with a sensible max-age.
HSTS tells browsers to use HTTPS for your domain automatically, which protects visitors from downgrade attacks on public Wi-Fi. includeSubDomains extends that to every subdomain – only add it when all subdomains support HTTPS – and preload is only for sites that want to be built into browsers’ HSTS lists.
Mixed content – images or scripts loaded over plain http on an https page – is also flagged, because it triggers warnings or blocked resources. Fix those addresses in your templates or content, then run the check again.
Run the check after every certificate renewal, server move or CDN change, because those are the moments when chains break, redirects change or HSTS headers disappear. Expired certificates make browsers show a full-page warning that most visitors will not click through, so an early warning about expiry is worth having.
Remember subdomains such as www, shop or mail: each needs a valid certificate, and HSTS with includeSubDomains will make browsers refuse any subdomain that still lacks one.