Informational, non-invasive checks: is HTTPS available, does HTTP redirect to HTTPS, what certificates were issued for the domain, which security headers the server sends, and are there mixed-content references in the page HTML.
What this tool does
- Requests the HTTPS version of the domain through the microLink API and reports the real status.
- Requests the HTTP version and checks whether it redirects to HTTPS (verified via microLink and the raw first response from hackertarget).
- Lists certificates issued for the domain from crt.sh (Certificate Transparency logs), with issuers, validity periods and days until expiry, newest first.
- Shows the security headers the server actually sends (HSTS, CSP, X-Content-Type-Options and more).
- Scans the live page HTML for plain-HTTP resource references (mixed content).
What it deliberately does not do
No intrusive security testing. No port scans, no vulnerability probing, no connection attacks. Browsers also cannot expose some things to JavaScript (like the negotiated TLS version), so those are reported as “Not available in this test” instead of being guessed.
Limitations & transparency
Certificate Transparency lists certificates that were issued for the domain — it cannot show the certificate the server currently presents on the wire, because browsers hide live certificate details from web pages for privacy. The tool therefore reports the newest issued certificate and its expiry, with this caveat clearly stated. crt.sh can be slow; if it times out the tool says so.
The domain is transmitted to microLink, hackertarget, crt.sh and (for the HTML scan) a retrieval endpoint. Nothing is stored by this site. See the Privacy Policy.
FAQ
Why can't you read the live certificate like an SSL-checker website does?
Most SSL-checker websites run their own server that performs a real TLS handshake. This is a static, browser-only page: JavaScript cannot read certificate details of other sites, by design. The transparency-log route is the closest legitimate equivalent, and it is clearly labeled.
Several certificates appear in the list. Which one is real?
All of them were genuinely issued for the domain at some point (or for a matching name). The newest entry is the most likely to be in use. For the definitive answer you would need a real TLS handshake from a server.
What if HTTPS shows an error status or the site doesn't redirect?
That means the HTTPS version returned an error status at check time, or the HTTP version served content instead of redirecting to HTTPS. Browsers still connect, but it is worth investigating — try the HTTP Status Checker for details.
Is it safe to check a site I don't own?
Yes. The checks are the same kinds of requests a visitor makes anyway (HTTPS page loads, HTTP page loads, public DNS/transparency lookups). No scanning, brute-force or exploitation is performed.