HTTPS Checker — Verify SSL Certificate and HTTPS Setup Instantly
Enter any domain and check whether HTTPS is active, the SSL certificate is valid, the HTTP-to-HTTPS redirect is in place, and HSTS is configured. Instant results, no login required.
HTTPS Checker
Enter any website URL to verify its HTTPS configuration, check SSL certificate validity, confirm the HTTP-to-HTTPS redirect, and detect mixed content or HSTS issues.
Checking HTTPS configuration…
Enter a URL above to check its HTTPS configuration
Why HTTPS Matters
- Google uses HTTPS as a ranking signal
- Encrypts data between user and server
- Required for Chrome's "Secure" badge
- HTTP-only sites show "Not Secure" warning
- HSTS prevents downgrade attacks
What Is It
What Is an HTTPS Checker?
An HTTPS checker is a free tool that tests whether a website is correctly configured to serve pages over a secure HTTPS connection. It checks whether the SSL or TLS certificate is valid, whether HTTP traffic redirects to HTTPS, whether the certificate has expired or is about to expire, and whether the HSTS security header is in place.
HTTPS is the encrypted version of HTTP. When a site uses HTTPS, all data sent between the visitor's browser and the server is encrypted. Without it, anyone on the same network can intercept and read that data. Browsers flag HTTP-only sites as "Not Secure" and Google treats HTTPS as a confirmed ranking signal.
Many HTTPS problems are invisible in a normal browser visit. An expired SSL certificate, a missing redirect from HTTP, or mixed content loading on an HTTPS page can each cause trust warnings, ranking drops, or broken padlock icons without being immediately obvious. This tool surfaces those issues in one pass.
What the checker tests on every URL
SEO and Trust Impact
Why HTTPS Matters for SEO and User Trust
HTTPS affects your rankings, your conversion rate, and whether visitors trust your site enough to stay on it. Getting it wrong has consequences that go beyond a padlock icon.
Google Uses HTTPS as a Ranking Signal
Google confirmed HTTPS as a ranking signal in 2014 and has continued to strengthen that position. Sites on HTTPS have a small but confirmed ranking advantage over equivalent HTTP pages. More importantly, HTTP pages show a "Not Secure" warning in Chrome, which reduces click-through rates from search results.
Browsers Warn Users on HTTP Sites
Chrome, Firefox, and Safari display a "Not Secure" warning in the address bar for any HTTP page that accepts form input. On login pages, checkout pages, and contact forms, this warning directly reduces conversions because users see it before they type anything.
HTTPS Encrypts All Data in Transit
Without HTTPS, all data sent between the user's browser and the server is transmitted in plain text. Anyone on the same network — a shared WiFi point, an ISP, or a malicious actor — can read or modify that data. HTTPS encrypts the connection so data cannot be intercepted in transit.
HTTP Pages Lose Referral Data
When a user clicks a link from an HTTPS page to an HTTP page, the referral information is stripped by the browser. Your analytics will record that traffic as "direct" instead of showing the correct source. Fixing HTTPS restores accurate referral attribution in Google Analytics and other tracking tools.
HTTPS Enables HTTP/2 and Faster Loading
HTTP/2 — which improves page load speed through multiplexing and header compression — requires HTTPS in all major browsers. Sites still on HTTP cannot benefit from HTTP/2 speed improvements, which affects Core Web Vitals scores and Largest Contentful Paint times.
SSL Certificates Build Credibility
A valid SSL certificate from a trusted certificate authority shows visitors the padlock icon in the address bar. For eCommerce sites, professional services, and any site collecting user data, the padlock is a basic trust signal. An expired or invalid certificate removes it and replaces it with a security warning.
How It Works
How the HTTPS Checker Works
Three steps from URL to full HTTPS security report.
Enter the Website URL
Paste any website URL. The checker accepts HTTP and HTTPS URLs and tests the domain's full HTTPS configuration regardless of which protocol you enter.
We Test the HTTPS Setup
The tool makes a live connection to the domain and runs a series of checks: HTTPS availability, SSL certificate validity and expiry, HTTP-to-HTTPS redirect status, certificate issuer, and HSTS header presence. Each check is tested independently.
Review Your HTTPS Report
Results show a pass or warning for each check with a clear label and detail value. A summary score shows the overall HTTPS health at a glance. Any failed checks identify exactly what needs fixing.
Tool Capabilities
What This Tool Checks
Everything you need to verify HTTPS is set up correctly and your SSL certificate is healthy.
HTTPS Availability
Confirms whether the domain is accessible over a secure HTTPS connection. A site that only responds on HTTP has no encryption and will show a browser security warning to visitors.
SSL Certificate Validity
Verifies the SSL or TLS certificate is currently valid, trusted by major browsers, and has not expired. An invalid or self-signed certificate triggers a full-page security warning that most users will not click past.
Certificate Expiry Date
Reports the date the SSL certificate expires. Certificates typically expire every 90 days (Let's Encrypt) or 1 year (paid CAs). An expired certificate breaks HTTPS for all visitors immediately and requires urgent renewal.
Certificate Issuer
Shows which certificate authority issued the SSL certificate. Major trusted issuers include Let's Encrypt, DigiCert, Comodo, and Sectigo. A certificate from an untrusted or unknown issuer will not be recognised by browsers.
HTTP to HTTPS Redirect
Tests whether entering the HTTP version of the domain correctly redirects to HTTPS. This redirect should be a 301 Permanent redirect. A missing or temporary redirect means HTTP pages are accessible without encryption alongside the HTTPS version.
HSTS Header
Checks whether the Strict-Transport-Security header is present in the server response. HSTS tells browsers to always use HTTPS for the domain automatically, preventing downgrade attacks where a user is silently redirected from HTTPS to HTTP.
Background Knowledge
SSL, TLS and HTTPS Explained
These three terms are often used interchangeably. Here is what each one actually means and how they relate to each other.
| Term | What It Is | What It Does | Current Status |
|---|---|---|---|
| SSL | Secure Sockets Layer | The original encryption protocol for securing connections between browsers and servers. Created in the 1990s by Netscape. | Deprecated. SSL 2.0 and 3.0 are both obsolete and insecure. The term "SSL certificate" is still widely used even though the underlying protocol is TLS. |
| TLS | Transport Layer Security | The modern replacement for SSL. TLS 1.2 and TLS 1.3 are the current standards. Encrypts data in transit between the browser and server. | Active. TLS 1.3 is the recommended version. TLS 1.0 and 1.1 are deprecated. All modern HTTPS connections use TLS, not SSL. |
| HTTPS | HyperText Transfer Protocol Secure | HTTP with TLS encryption layered on top. All data sent over HTTPS is encrypted. The browser shows a padlock icon when HTTPS is active. | Active. The standard for all websites. Google requires HTTPS for Chrome's "Secure" status and treats it as a ranking signal. |
| SSL Certificate | Digital certificate issued by a Certificate Authority | Proves to the browser that the server is who it claims to be. Contains the domain name, issuer, and expiry date. Without it, HTTPS cannot work. | Required. Must be issued by a trusted Certificate Authority. Free certificates from Let's Encrypt are widely used and trusted by all major browsers. |
| HSTS | HTTP Strict Transport Security | A security header that tells browsers to always connect using HTTPS for the domain, even if the user types HTTP manually or follows an HTTP link. | Recommended. Not required but strongly advised for any site that has fully migrated to HTTPS. Prevents downgrade and man-in-the-middle attacks. |
Common Problems
Common HTTPS Problems and What They Mean
Most HTTPS issues fall into a small number of recurring patterns. Here is what each one means and why it matters.
Expired SSL Certificate
When an SSL certificate passes its expiry date, browsers immediately display a full-page security warning telling visitors the connection is not private. Most users will not proceed past this warning. Certificate expiry is the most urgent HTTPS problem — it needs to be fixed within hours, not days. Let's Encrypt certificates expire every 90 days. If auto-renewal is not configured, they expire silently.
Domain Mismatch on the Certificate
A certificate is issued for a specific domain. If the certificate is for example.com but the site is accessed at www.example.com, or if the certificate was issued for a different domain entirely, the browser displays a "Your connection is not private" error. The certificate must cover the exact domain being accessed, including the www subdomain if it is used.
Mixed Content on HTTPS Pages
Mixed content happens when an HTTPS page loads resources — images, scripts, stylesheets, iframes — over HTTP. The browser blocks or warns about insecure content on an otherwise secure page, breaking the padlock icon. This typically happens after migrating from HTTP to HTTPS when internal links and asset URLs have not been updated to HTTPS.
Missing HTTP to HTTPS Redirect
If the HTTP version of a site is accessible without redirecting to HTTPS, the site is serving duplicate content over two protocols. Google may index both versions, splitting link equity and creating canonicalization problems. All HTTP traffic should redirect to HTTPS with a 301. Use the redirect checker to verify the redirect is in place and using the right status code.
Missing HSTS Header
Without the HSTS header, a user who manually types "http://" before the domain or follows an old HTTP link can briefly connect over an unencrypted connection before being redirected to HTTPS. This small window is enough for a downgrade attack on unsecured networks. Adding a Strict-Transport-Security header closes this gap and tells browsers to always use HTTPS without attempting HTTP first.
Internal Links Still Using HTTP After Migration
After migrating to HTTPS, internal links within the site that still use HTTP URLs create unnecessary redirect hops. Every time a user or Googlebot follows an internal link to an HTTP URL that then redirects to HTTPS, that is an extra request and a small loss of PageRank. Update all internal links to use HTTPS URLs directly. Pair this with a broken link checker to find any remaining HTTP references in your content.
How to Fix
How to Fix HTTPS and SSL Issues
Once the checker identifies the problem, the fix for each common HTTPS issue is well-documented and usually straightforward.
Renew or Install Your SSL Certificate
If the certificate is expired or missing, install a new one through your hosting provider or certificate authority. Let's Encrypt certificates are free and widely supported. Most hosting panels (cPanel, Plesk, Cloudflare) offer one-click SSL installation. Set up auto-renewal so the certificate never expires again — Let's Encrypt's Certbot handles this automatically.
Set Up a 301 Redirect from HTTP to HTTPS
Add a 301 redirect rule in your .htaccess file (Apache) or Nginx config to send all HTTP traffic to the HTTPS version. Most CMS platforms have a setting for this: WordPress has it in Settings, Shopify forces HTTPS automatically, and Cloudflare can enforce it at the edge. After setting it up, verify it with the HTTP status checker to confirm the redirect returns 301.
Fix Mixed Content by Updating Asset URLs
Find and update any HTTP references to images, scripts, and stylesheets in your site's source code, database, and CMS settings. In WordPress, use the Search Replace tool in the database or a plugin like Better Search Replace to update all http:// references to https://. Check the browser console (F12) on affected pages to see which specific resources are loading over HTTP.
Add the HSTS Header to Your Server Config
Add the following header to your server configuration: Strict-Transport-Security: max-age=31536000; includeSubDomains. This tells browsers to use HTTPS for the domain for the next year without attempting HTTP. Test this on a staging environment first — once HSTS is sent with a long max-age, it cannot be easily reversed if you need to go back to HTTP.
Update Internal Links and Canonical Tags to HTTPS
After migrating to HTTPS, update all internal links, canonical tags, XML sitemap URLs, and hreflang tags to use HTTPS URLs. Each HTTP internal link creates an unnecessary redirect hop that wastes crawl budget and slightly dilutes PageRank. Check your sitemap URLs return 200 HTTPS responses using the sitemap checker after updating them.
Who It's For
Who Should Use an HTTPS Checker?
Anyone responsible for a website's security, technical health, or search performance.
When to use this tool:
- Before and after migrating a site from HTTP to HTTPS
- When a browser is showing a "Not Secure" or certificate warning on your site
- To check SSL certificate expiry dates on client sites during regular audits
- After a hosting change or domain transfer to confirm HTTPS is still correctly configured
- When investigating a drop in organic traffic that may be related to an HTTPS issue
- To verify competitor sites' HTTPS setup as part of a full technical SEO audit
Related Tools
Related Technical SEO and Security Tools
Use these alongside the HTTPS checker for a complete technical and security audit.
Check HTTPS Status, Free
Verify your SSL certificate, confirm your HTTP-to-HTTPS redirect, and check your HSTS setup in one click. No login, no install, instant results.
Check HTTPS Status Free Verify SSL Certificate NowFrequently Asked Questions
Common questions about HTTPS, SSL certificates, and website security.