Website HTTPS and security checks
A website can display a padlock and still have other weaknesses. This checker reviews observable HTTPS and HTTP configuration signals to help site owners spot common problems.
Check website security settingsThe main checker opens in its existing compact interface. Results are not indexed as public content.
What an HTTPS check tells you
HTTPS encrypts traffic between a browser and the server endpoint that presents the certificate. A certificate check can verify the current certificate chain and expiration under the test conditions. It does not establish whether every page, plugin or server component is safe.
When a website redirects from HTTP to HTTPS, visitors are less likely to continue over unencrypted connections. HSTS can further instruct compatible browsers to prefer HTTPS for subsequent connections after receiving the policy.
Security response headers
Content-Security-Policy can restrict permitted script and asset sources, reducing some classes of injection risk. X-Content-Type-Options, Referrer-Policy, Permissions-Policy and framing controls each influence distinct browser behaviors.
The presence of a header is not enough to prove it is configured correctly. Some policies require application-specific review; for example, a very permissive Content-Security-Policy might offer little useful protection.
CDNs, origin servers and DNS
A CDN or reverse proxy can cache content and filter traffic, but simply detecting a provider is not proof that its security controls are enabled. Website protection reports can note proxy or CDN signals and potential origin-address exposure indicators.
DNS records may reveal hosting arrangements, but a public A record alone does not demonstrate a successful bypass or exploit. Treat automated origin clues as leads for your own configuration review, not confirmed vulnerabilities.
How to interpret missing results
Some sites intentionally block automated requests; connection timeouts, redirects, IPv6-only hosting or geofencing can affect what a remote checker observes. Missing or unavailable checks should not be mistaken for a safe result.
To use the tool, submit the public website domain, choose Website security and examine the HTTPS, TLS and header sections. For detailed remediation, combine the findings with your server configuration and browser developer tools.