SSL certificate & HTTPS checker
Enter a domain to see how many days are left on its SSL certificate, who issued it, whether the site loads over HTTPS, redirects http to https, sends HSTS, and avoids insecure mixed content.
Why an expired certificate hurts
When a certificate expires, browsers show a full-page security warning instead of your site. Most visitors leave, while your ads keep spending. Certificates are getting shorter lifetimes (Let's Encrypt issues 90-day certificates), so automatic renewal and a reminder matter more each year.
What this checker looks at
- Certificate: days left, expiry date and issuer, read the same way a browser does.
- HTTPS connection: whether https://domain opens. Expired or wrong-name certificates usually make this fail.
- http → https redirect: visitors typing the bare domain get sent to the encrypted version.
- HSTS: the Strict-Transport-Security header tells browsers to always use HTTPS for the domain.
- Mixed content: an HTTPS page that still loads images, scripts or CSS over http://.
Common fixes
Cloudflare: SSL/TLS → Edge Certificates → turn on Always Use HTTPS; enable HSTS once the whole site works over HTTPS.
Your own nginx server — free Let's Encrypt certificate and a 301 redirect:
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run # confirm auto-renewal works
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Apache (.htaccess):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]WordPress: Settings → General → change both addresses to https:// (only after HTTPS works), then replace old http:// links in posts to clear mixed content.
Check your whole site, not just one thing
The free scan checks SSL, email spoofing, security headers, exposed sensitive files, outdated CMS and signs of hacking in one go, with plain-language fixes.
Free once you verify your domain: weekly re-scans and email alerts for new issues. PRO ($8/month): deep scan with 5,000+ known-vulnerability checks, deep re-scans up to 10 times a day and 5-minute uptime monitoring.
FAQ
How do I get reminded before my certificate expires?
Verify the domain on WebsiteScanner (meta tag, DNS record or Cloudflare, about a minute) and add an alert email. The weekly free monitoring emails you when the certificate has 14 days or less left, or is invalid.
Is a free certificate as secure as a paid one?
For encryption, yes: Let's Encrypt and Cloudflare certificates use the same TLS standards. Paid certificates differ mainly in organisation validation (OV/EV) and support.
I renewed but browsers still say expired. Why?
The web server is often still serving the old certificate. Reload or restart nginx/Apache after renewal, and check that a CDN or load balancer in front isn't holding its own copy.
Is enabling HSTS risky?
After enabling it, browsers refuse plain http for the whole max-age period, so a broken HTTPS setup locks visitors out. Enable it only when every subdomain works over HTTPS; start with a short max-age.