Check a site’s HTTPS and SSL certificate

How to use the tool

Enter a site address and click “Check”. The tool opens a secure connection on port 443, reads the certificate presented, then requests the page over http:// and https:// with no cache. Findings are sorted into “To fix”, “To note” and “OK”, followed by the certificate details and the list of http:// resources found in the page.

If you enter a specific page, that page is the one read for mixed content. To check the home page, enter only the site name. The certificate belongs to the host.

What the tool checks

First the certificate: the chain of trust, validity dates with the number of days left, the host name compared with the covered names (the “Subject Alternative Name” field), a possible self-signed certificate and the negotiated protocol. The “to renew” alert fires under 30 days: that is the tool’s own threshold, no source sets it.

Then the redirect from http:// to https://. Google recommends permanent server-side redirects, preferably 301 or 308.² An http:// page that answers 200 without redirecting leaves the site in two versions. A redirect that goes back from HTTPS to HTTP is the worst case: see below.

Next the HSTS header: its presence, its max-age, includeSubDomains and preload. Finally mixed content: each http:// resource in the HTML, sorted by what browsers do with it.

HTTPS and Google

Google prefers the HTTPS version of a page when it picks the canonical address. It makes exceptions when there are issues or conflicting signals, which it lists: an invalid SSL certificate, non-image dependencies served over HTTP, a redirect to or through an HTTP page.¹ The tool reflects these three cases in its findings.

On ranking, Google’s documentation lists secure serving among the aspects of page experience, then says there is no single signal and that beyond Core Web Vitals these aspects do not directly help a site rank higher.³ HTTPS therefore mostly serves to keep the canonical version and to protect visitors.

Mixed content

Mixed content is when an HTTPS page loads a resource over HTTP. MDN explains that such resources can be read, even modified, by an attacker, scripts being the most dangerous.⁴

Recent browsers tell two cases apart. “Upgraded” resources are rewritten to https automatically: images with src, audio, video and their sources. The others are blocked: scripts, stylesheets, frames, objects, images in srcset or inside a picture element. An image requested by IP address is never upgraded.⁴ The tool puts each resource in one of these two categories.

HSTS

The Strict-Transport-Security header tells the browser that a host is only visited over HTTPS. Its max-age gives the duration in seconds; includeSubDomains extends the rule to subdomains.⁵ RFC 6797 sets that the browser ignores a header received over HTTP, that a host must send only one, and that it must not put it in its HTTP responses.⁶

HSTS does not protect the very first visit, before the browser has received the header. The preload list fills that gap, provided there is a max-age of at least 31,536,000 seconds, includeSubDomains and the preload directive.⁵ HSTS remains optional: the tool flags it “to note” when it is missing, never “to fix”.

What the tool does not see

The tool reads the page’s HTML without running JavaScript: an http:// resource added by a script does not show up. It does not read stylesheets, so any http:// url() inside them escapes it. It reads 1.5 MB of HTML at most.

It does not check the full chain of intermediate certificates, does not test old TLS versions or the preload list itself, and shows the negotiated protocol without judging it. Each check counts as one request on a quota of 20 per 10 minutes and per visitor, shared with the site’s other tools. The server keeps neither the address nor the result.

After the test

Once HTTPS is in place, make sure there is only one hop: the redirect checker follows the whole chain. The HTTP headers analyser reads the other security headers, and the indexability test says whether the page stays indexable.

Frequently asked questions