🇮🇹 IT 🇬🇧 EN

Website Health Check

HTTPS, SSL certificate, redirects, security headers, www consistency and speed: a grade and what to fix

Privacy and limits

🔒 The check is run by our server against the domain you enter, one site at a time and with a request limit. We do not store the results. Only public addresses are allowed: internal or reserved addresses are rejected.

Did your site fail the check?

I handle HTTPS, certificates, security headers and hardening of websites and servers.
Message me on WhatsApp Open a ticket

What this tool checks

  • HTTPS: whether the site is reachable over an encrypted connection.
  • HTTP → HTTPS redirect: whether clear-text visitors are moved to the secure version.
  • SSL/TLS certificate: who issued it, whether it covers the domain and in how many days it expires.
  • www / non-www consistency: whether there is a single canonical domain, to avoid duplicate content.
  • Security headers: HSTS, Content-Security-Policy, X-Frame-Options and others.
  • Response time: how long the site takes to respond.

Why the SSL certificate matters

The SSL/TLS certificate is what makes HTTPS possible and shows the padlock in the browser. If it expires, visitors get a full-page security warning and many leave.

The most common cause of a site suddenly turning "not secure" is exactly an expired certificate: this check tells you in advance how many days are left.

Security headers

They are instructions the site sends to the browser to protect visitors:

  • HSTS: forces HTTPS to always be used.
  • Content-Security-Policy: limits where scripts can load from, reducing attack risk.
  • X-Frame-Options: prevents the site from being framed by others (clickjacking).
  • X-Content-Type-Options and Referrer-Policy: further privacy and security measures.

A low grade: what it means

The grade sums up the checks: A is excellent, F flags serious issues. A low grade does not mean the site is compromised, but that there are things to fix: an expiring certificate, HTTPS not forced, missing headers.

These are typical sysadmin maintenance tasks: if you like, I can fix them for you.

Frequently asked questions

Enter the domain above: the check shows who issued the certificate, whether it covers the domain and in how many days it expires. An expired certificate makes the site inaccessible with a security warning.

It sums up the checks on HTTPS, certificate, redirects, security headers, www consistency and speed. A means a solid configuration, F flags issues to fix.

No. It only makes a few read requests, like a normal visitor, and changes nothing on the site.

Some sites block automated requests or respond only under certain conditions. In that case the check shows what it can see; try with and without www.

No: for security reasons only public domains are allowed. Internal, private or reserved addresses are rejected.

Related tools

What a website sees about you HTTP status codes URL Decoder / Defanger