EngineeringScoreFree SSL checker
Check whether your site is served over HTTPS, redirects from HTTP, sends a strong HSTS header, and loads without mixed content, in one scan, no signup.
We read one page, in one state, without signing in. Being clear about the edges is the point: a scanner that implies it sees everything is the one to distrust. See exactly what we can't see →
- 5 checks each pass, fail, or needs review
- Under a minute one page, one scan
- No signup no account, no email
What we check
HTTPS
The scanned URL resolves and loads over https://, not http://Pass or fail: served over HTTPS, or not.
Without HTTPS, every request and response, including login form submissions, travels in plain text and can be read or altered by anyone on the same network path.
Learn more about HTTPS →HTTP to HTTPS redirect
A request to the http:// version of your site that responds with a redirect to https://Pass if the HTTP version redirects, fail if we can reach the HTTP version and it does not, and skipped rather than scored either way if we could not determine it, for instance a site only ever reachable over HTTPS directly.
Without a redirect, a visitor who types your domain without https:// or follows an old http:// link is served the response in plain text before anything can upgrade the connection.
Learn more about HTTP to HTTPS redirect →Strict-Transport-Security (HSTS)
Strict-Transport-Security: max-age=<seconds>On sites served over HTTPS, present with a max-age of at least 15,552,000 seconds (180 days), the floor the code names LONG_LIVED_HSTS_MAX_AGE.
Without it, a browser that has never visited your site before still tries plain HTTP first, giving an attacker on the network a window to intercept that first request.
Learn more about Strict-Transport-Security (HSTS) →HSTS (present but ineffective)
max-age=0, a header with no parseable max-age, or a value under 15,552,000 secondsScored as its own fail, not folded into a missing header: the site has done the work of adding the header, so the fix is different, raise the number or fix the syntax, from adding it from scratch.
A max-age of 0 actively tells browsers that already trust your site to forget that policy immediately, reopening the exact downgrade window a real HSTS policy closes.
Learn more about HSTS (present but ineffective) →Mixed content
Any resource, script, stylesheet, image, or otherwise, requested over http:// while the page itself is served over https://Flagged if one or more insecure requests are found while the page is on HTTPS; we list up to five examples by URL.
A single HTTP request on an HTTPS page can be intercepted and swapped for something else in transit, for example a tampered script, while the padlock in the address bar still shows secure.
Learn more about Mixed content →
What we can't see
- Your TLS certificate's issuer, expiry date, or cipher suite: we check whether the connection is HTTPS at all, not the certificate details behind it.
- Whether HTTP to HTTPS redirect happens, if we could only ever reach your site over HTTPS directly. We report that as skipped, not as a pass we never actually checked.
- HSTS preload list status: we read the header your server sends, not whether your domain is on Chromium's preload list.
- Mixed content that only appears after a user interaction, a click, a scroll, a form submission: we read the page as it loads, once.
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.