SSL & Security Headers Checker
Check the SSL certificate and key security headers for a website
Working...
Why check SSL & security headers?
Inspect certificate expiry and response headers to identify configuration items for review. A header checklist is not a complete security assessment.
The checker inspects the exposed TLS certificate and reports selected response headers, including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Presence does not establish that a policy is effective, and absence alone does not prove an exploitable vulnerability. Review the actual directives and application behavior. Test CSP before enforcing it and check embedding requirements before restricting frames. Recheck the exact hostname and route after changes; a CDN may modify headers independently of the origin.
- SSL certificate expiry date and days remaining
- Checklist of the 6 most important security headers
- Early warning before the certificate expires
Example: interpret a finding and fix it
Illustration only, not a check of your website.
A page has a valid certificate but no CSP header. That finding calls for a resource-policy review; it does not by itself establish an XSS vulnerability.
Inventory legitimate scripts, images, fonts and frames before designing a CSP. Trial it with Content-Security-Policy-Report-Only and exercise login and checkout flows before considering enforcement.
X-Frame-Options and CSP frame-ancestors can protect embedding. Evaluate the effective policy instead of adding duplicate headers for a score. One TLS handshake and header inspection cannot replace an application security assessment.
How to use in 3 steps
- 1Enter the website URL to check (must be HTTPS to read the certificate).
- 2Click "Check security" — the tool performs a TLS handshake and reads response headers.
- 3Review the SSL certificate expiry and the 6-header security checklist.