SSL / TLS Checker

How it works

Transport security starts with HTTPS, but “the padlock is green” is not the whole story for a product you ask users to trust. Paste a public URL and we confirm the host is reachable, whether the request and final URL stay on HTTPS, and whether HSTS appears on the response. Private and link-local hosts are blocked by our SSRF-safe fetch layer.\n\nCertificate chain depth, cipher suites, and expiry calendars are limited in this free teaser because edge Workers cannot fully inspect the TLS handshake the way a dedicated scanner can. We are honest about that: you get continuity signals and reachability, not a full SSL Labs-style report. That is still useful before launch - many vibe-coded apps still serve marketing pages on HTTP or lose HTTPS across a redirect hop.\n\nIf the final URL drops to HTTP, or HSTS is missing on an otherwise HTTPS site, fix that at the CDN or app layer before you pour traffic into ads. Then enable monitoring so expiry and downtime do not ambush you on a Friday.\n\nThis is not a penetration test. Pair it with the Website Security Score and a full AtRisk scan when you want severity depth, recurring checks, and fix prompts your coding agent can apply. Before a launch, confirm both apex and www (or app subdomain) behave the same way, and that marketing pages do not bounce users onto an HTTP mirror. Turn on HSTS once you are confident HTTPS works everywhere, starting with a moderate max-age. Certificate auto-renewal failures are a leading cause of weekend outages for indie SaaS - monitors matter more than a one-off check. Use this tool as a smoke test, then graduate to AtRisk monitoring for continuity over time.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.