How the secure connection check works
The padlock in the browser rests on two things: a valid certificate for your address, and a server that only uses current encryption. This check looks at both, and at whether visitors who arrive on the insecure http:// address are sent to the secure one.
What it reads
- A TLS handshake with your server, the same first step a browser takes, which shows the certificate and the encryption version in use.
- A short test of whether the server still accepts TLS 1.0 or 1.1, outdated versions that browsers no longer use.
- One request to the
http://version of your address, without following redirects, to see whether it sends visitors tohttps://. - The home page (already fetched for other checks), for parts loaded over
http://. - The same handshake and redirect test on other addresses under your domain that your own site names, such as
www..
What it reports
- No working
https://at all, whilehttp://answers. - A certificate that has expired, expires within 14 days, or expires within 30 days.
- A certificate issued for a different name, or one browsers do not trust (self-signed, or an incomplete chain).
- TLS 1.0 or 1.1 still accepted, on your address or a named sibling address.
http://not redirecting tohttps://.- Mixed content: images, scripts or frames on a secure page loaded over
http://. - An HSTS header without
preload, as information only.
What it cannot see
- Certificates and settings on addresses your site never names. The scanner does not guess subdomains.
- Whether certificate renewal is automated. An expiry date far away does not tell us how it will be renewed.
- Mixed content on pages other than the home page, or added later by scripts.
What to do with the result
Expired or mismatched certificates need attention the same day, because browsers show a full-page warning instead of your site. Most hosts offer free automatic certificates (Let's Encrypt); ask your host to switch it on. Turning off TLS 1.0 and 1.1 and adding the http:// redirect are small server or CDN settings.
See what this looks like on your own site: a free, passive check in about two minutes.
Check my websiteEverything this check can report
- SeriousSite is not served over HTTPS
- ModerateHTTP does not redirect to HTTPS
- CriticalTLS certificate has expired
- SeriousTLS certificate expires within 14 days
- ModerateTLS certificate expires within 30 days
- SeriousTLS certificate does not match the host name
- SeriousTLS certificate chain is not trusted
- MinorLegacy TLS 1.0 or 1.1 offered
- InfoHSTS preload not configured
- ModerateMixed content: insecure resources on a secure page
- InfoTLS could not be checked
Severity is fixed per finding in our code and never set by the AI that writes the report text. How severity becomes a score is on the methodology page.
The other checks
- How the security headers check works · The instructions your server sends to browsers with every page.
- How the cookies check works · Whether the cookies your site sets are protected on the way and in the browser.
- How the email and DNS check works · The public DNS records that stop fake email in your name, and addresses pointing to services you no longer use.
- How the technology check works · What your site is built with, worked out from what it shows publicly.
- How the vulnerability wave check works · Whether what we can see matches a major vulnerability in the news.
- How the known flaws in components check works · Whether a library or framework version your site shows has a published security advisory.