Skip to content
Check a domain

HTTPS check

Runs in every scan · 7 checks

Check your HTTPS redirect and HSTSso every visit is a secure one.

Confirm that visitors always reach the secure version of your site, and that browsers remember to keep it that way.

  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription

What we check

What we look at.Each with evidence and a fix.

Part of every Quick Scan, alongside the other checks.

  • Answers over HTTPS

    Your homepage loads on a secure connection.

  • Redirect from http://

    Visitors who type http:// are moved to https://.

  • HSTS

    Browsers told to always use HTTPS, for long enough to count.

  • Mixed content

    Your secure page loads its scripts, styles and images securely too.

  • Forms and password boxes

    Sent over HTTPS, from a page on HTTPS.

  • Encryption strength (TLS)

    Modern protocol versions, strong ciphers and forward secrecy.

  • Your certificate

    Valid, matches your domain, complete chain, not about to expire.

Why it matters

Small settings.A big difference for your visitors.

  • Private by default

    Logins, forms and pages travel encrypted.

  • No browser warnings

    Visitors see the padlock, not a "not secure" label.

  • Every return visit secure

    HSTS sends browsers straight to https://.

What a finding looks like

Plain English.With the evidence behind it.

Open the full sample report

F7 · https-behaviour

Your site answers over HTTPS and redirects plain HTTP

Informational Confirmed Minutes

What it means
Visitors who arrive over http:// are moved to an encrypted connection.
Evidence
GET http://example.com/ → 301
GET https://example.com/ → 200
Fix
Nothing to do.

F4 · security-headers

Tell browsers to always use HTTPS

Low Confirmed Minutes

What it means
An HSTS header sends browsers straight to https://, even when a visitor types your address without it, so after the first visit, every return visit goes straight to an encrypted connection. Adding your site to the HSTS preload list covers the very first visit too.
Evidence
Strict-Transport-Security: (header absent)
Expected
Strict-Transport-Security: max-age=31536000; includeSubDomains
Fix
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS.

How to fix it

A few clear steps.In the order to take them.

Your report has the exact fix for your site, ready to forward to whoever looks after it.

  1. Turn on HTTPS at your host. Most hosts include a free certificate that renews itself.

  2. Redirect every http:// address to its https:// twin with a permanent (301) redirect.

  3. Add an HSTS header. Start with a short max-age while you test, then move to a year.

  4. Change any http:// links to scripts, styles and images on your pages to https://.

HSTS header
Strict-Transport-Security: max-age=31536000; includeSubDomains

Questions

HTTPS and HSTS questions.

Something else? support@scandefend.com

Why does my site still open on http://?

HTTPS can be switched on without a redirect, so both versions keep working. Add a permanent (301) redirect from http:// to https:// at your host, CDN or server and every visitor ends up on the secure version.

What is HSTS and do I need it?

HSTS is a header that tells browsers to use HTTPS for your site from then on, even if someone types http://. After the first visit, every return visit goes straight to an encrypted connection. Adding your site to the HSTS preload list covers the very first visit too.

What max-age should HSTS use?

A year (31536000 seconds) is the common recommendation. Start shorter while you confirm every page and subdomain works over HTTPS, then raise it.

What is mixed content?

A secure page that loads some of its parts over plain http://. Browsers block insecure scripts outright and flag insecure images, so switching those links to https:// keeps the page whole and the padlock clean.

Do you grade my SSL/TLS settings?

Yes. Every check includes a full encryption (TLS) test: which protocol versions your server offers, how strong its ciphers are, forward secrecy, and your certificate (valid dates, domain match, chain and key strength). Each finding comes with a plain-English fix.

Keep exploring

Also useful: What we check Sample report Pricing For small businesses Let ScanDefend in

See what your website shows.Know what to fix first.

See pricing