Skip to content
Check a domain

SSL checker · first check free

SSL checker: is your website's HTTPS set up properly?

Check the certificate and encryption on a website you own: valid, matching your domain, not about to expire, and using modern TLS. Part of a full website security check.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

  • No card for the free check
  • Results usually in minutes
  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription needed
  • View sample report

Quick Scan

Areas checked
11
In good shape
4
Fixes in minutes
3 of 5
  1. Medium

    Protect the session cookie

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

    Fix

    1. Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider.
    2. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors.
    3. When the reports show your real mail passes, move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 3 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

Your SSL certificate (strictly, TLS) is what puts the padlock in the address bar. We check that your certificate is valid and complete, that your encryption settings are modern, and that every visit ends up on HTTPS and stays there.

  • Your first check is free: create an account and confirm your email.
  • Your certificate: valid, matches your domain, complete chain, expiry date
  • Encryption strength: protocol versions, ciphers and forward secrecy
  • For websites you own; HTTPS redirects, HSTS and the rest of your site are checked too

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription needed.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription needed.

  • One credit checks one website
  • Credits last 12 months
  • One-off payment, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work
Check my SSL

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

What we check

Everything we check for HTTPS.Certificate, encryption and redirects.

Part of every Quick Scan, alongside the other checks.

  • Answers over HTTPS

    Your homepage loads on a secure connection.

  • Redirect from http://

    Visitors who type http:// are moved to https://.

  • HSTS

    Browsers told to always use HTTPS, for long enough to count.

  • Mixed content

    Your secure page loads its scripts, styles and images securely too.

  • Forms and password boxes

    Sent over HTTPS, from a page on HTTPS.

  • Encryption strength (TLS)

    Modern protocol versions, strong ciphers and forward secrecy.

  • Your certificate

    Valid, matches your domain, complete chain, not about to expire.

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F4 · security-headers

Tell browsers to always use HTTPS

Low Confirmed Minutes

What it means
An HSTS header sends browsers straight to https://, even when a visitor types your address without it, so after the first visit, every return visit goes straight to an encrypted connection.
Evidence
Strict-Transport-Security: (header absent)
Expected
Strict-Transport-Security: max-age=31536000
Fix
Send Strict-Transport-Security in stages: max-age=300 first, then a week, then max-age=31536000 once every page works over HTTPS. Add includeSubDomains only when every subdomain works over HTTPS. Leave preload off unless you're sure: it is hard to undo.

F2 · cookie-flags

Protect the session cookie

Medium Confirmed Minutes

What it means
Your homepage sets a session cookie without the Secure and HttpOnly flags. Secure keeps it on encrypted connections; HttpOnly keeps it away from scripts in the page, so an injected script can't read it.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.

Questions

Short answers.

Something else? support@scandefend.com

Is this a free SSL test?

It's part of a full website security check, from $8 a check with no subscription.

My site has a padlock. What else is there to check?

The padlock means the certificate is accepted today. The report also looks at when it expires, whether older, weaker encryption is still switched on, and whether visitors who type http:// are moved to HTTPS.

Do I need to install anything?

No. It's an outside, read-only check of what your website shows the public.

Keep exploring

Also useful: What we check

See what your website shows.Know what to fix first.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

See pricing