Certificate and security headers checker
Is the certificate of a website valid, and for how long? Does it force HTTPS? Does it send the headers that protect its visitors? One look, a grade, and what to change.
We request the home page from our servers, like a browser (over HTTP, then HTTPS, following up to three redirects), and nothing else.
Questions
Why a grade?
It sums up the findings below: a broken certificate or a site without HTTPS costs a lot, a missing header a little. It is a guide, not a certification.
Which headers matter most?
HSTS (always HTTPS), Content-Security-Policy (what the page may load and run), protection against framing, and nosniff. Most hosts and CDNs let you add them in their settings.
Do you store anything?
The result is kept ten minutes so that the same site is not requested again and again, then forgotten. Your address is used only to limit abuse.