Is the SSL and security headers checker free?

Yes. You confirm your email once with a 6-digit code, then you can check any domain as often as you like for 30 days. No credit card and no paid tier.

My SSL certificate is valid. Why is my grade still low?

A valid certificate only covers encryption. The grade also counts the security headers, and most small business sites send none of them. Adding HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy usually lifts a site from F or D to B in a few minutes.

Will adding a Content-Security-Policy break my website?

It can if it is too strict, because it blocks any script or style that is not on the allowed list, including chat widgets, analytics and embedded maps. That is why we suggest starting with Content-Security-Policy-Report-Only, watching what it reports, and then enforcing it.

Is X-XSS-Protection still needed?

No. Modern browsers removed the XSS filter it controlled, so the header does nothing today. A Content-Security-Policy is the modern replacement, which is why this tool does not score X-XSS-Protection.

How do I add security headers in WordPress or on shared hosting?

On Apache hosting (most shared plans) paste the Apache lines from your report into the .htaccess file in the site root, after making a backup. On Nginx they go in the server block. Some hosts and CDNs such as Cloudflare also let you add response headers from their dashboard.

What does HSTS preload mean?

Preload puts your domain on a list built into browsers, so they never try plain http even on the first visit. Only add the preload flag once every subdomain works over HTTPS, because removal from the list takes months.

Can you fix these issues for me?

Yes. Our website fixing service starts from $100. Or we build you a new website and app for free with security headers and auto-renewing SSL set up from day one; you see it finished and pay $150 one-time only if you are happy.

Free tool

Free SSL & Security Headers Checker

Enter your domain and see, in about 15 seconds, whether your SSL certificate is trusted and when it expires, which TLS versions your server accepts, and which of the security headers browsers rely on are missing. You get a grade from A+ to F, a plain-English reason for every item, and ready-to-paste lines for Apache (.htaccess) and Nginx that add what is missing.

Step 1: verify your email

We send a 6-digit code. Verify once and use every free tool for 30 days. We send no other emails.

What this checker tests

We connect to your site the way a browser does, read the certificate and the response headers of your homepage, and run 17 checks in two groups. We never log in, install anything or test for weaknesses by attacking the site.

SSL / TLS: HTTPS works, the certificate is trusted and matches your domain, how many days are left, whether it covers both www and non-www, the TLS version used, whether old TLS 1.0 / 1.1 are still accepted, the http:// to https:// redirect, and your CAA DNS record.
Security headers: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Leaks and hygiene: Secure, HttpOnly and SameSite flags on cookies, server or PHP version numbers shown in headers, and a /.well-known/security.txt contact file.

Why security headers matter for a small business site

Security headers are short instructions your server sends with every page. They tell the browser to always use HTTPS, to refuse to show your site inside someone else’s frame (a common trick to steal clicks or logins), not to guess file types, and which outside scripts are allowed to run. They cost nothing, take minutes to add, and close whole classes of attacks that hit contact forms, booking pages and client logins.

They also matter for trust. Insurance questionnaires, enterprise customers and PCI scans increasingly ask for HSTS and a Content-Security-Policy, and a missing or expired certificate shows a full-page “Your connection is not private” warning that sends almost every visitor back to Google.

Certificates now expire faster

Since 15 March 2026 public SSL certificates can be valid for at most 200 days. The limit drops to 100 days in March 2027 and to 47 days in March 2029. Sites that renew by hand once a year will break several times a year unless renewal is automatic, so this checker shows the days left and the full lifetime of your current certificate. Anything under 14 days left with no renewal yet usually means auto-renew is not working.

How to read the grade

Each check is green (fine), amber (works but weak) or red (a real problem). Grey items are for information only and do not change the grade. The grade is capped at F if the certificate is not trusted or HTTPS does not work at all, because no header can make up for that.

Fix red items first. If your site runs on shared hosting, the Apache lines at the end of the report go into the .htaccess file in your web root. Start a Content-Security-Policy in Report-Only mode for a week so you can see what it would block before you enforce it. Our website security guide explains each step, and if your site has already been tampered with, follow how to recover a hacked website.

What this tool does not check

It reads one page and the certificate on port 443. It does not scan for malware, outdated WordPress plugins or open ports, and it does not test your email security. For a quick look at speed, mobile and SEO use the website health check, and for a full review by a person ask for a free website audit.

Frequently asked questions

Is the SSL and security headers checker free?: Yes. You confirm your email once with a 6-digit code, then you can check any domain as often as you like for 30 days. No credit card and no paid tier.
My SSL certificate is valid. Why is my grade still low?: A valid certificate only covers encryption. The grade also counts the security headers, and most small business sites send none of them. Adding HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy usually lifts a site from F or D to B in a few minutes.
Will adding a Content-Security-Policy break my website?: It can if it is too strict, because it blocks any script or style that is not on the allowed list, including chat widgets, analytics and embedded maps. That is why we suggest starting with Content-Security-Policy-Report-Only, watching what it reports, and then enforcing it.
Is X-XSS-Protection still needed?: No. Modern browsers removed the XSS filter it controlled, so the header does nothing today. A Content-Security-Policy is the modern replacement, which is why this tool does not score X-XSS-Protection.
How do I add security headers in WordPress or on shared hosting?: On Apache hosting (most shared plans) paste the Apache lines from your report into the .htaccess file in the site root, after making a backup. On Nginx they go in the server block. Some hosts and CDNs such as Cloudflare also let you add response headers from their dashboard.
What does HSTS preload mean?: Preload puts your domain on a list built into browsers, so they never try plain http even on the first visit. Only add the preload flag once every subdomain works over HTTPS, because removal from the list takes months.
Can you fix these issues for me?: Yes. Our website fixing service starts from $100. Or we build you a new website and app for free with security headers and auto-renewing SSL set up from day one; you see it finished and pay $150 one-time only if you are happy.

Related guides & services

Guides related to this tool

All articles & guides →