Top 3 HTTPS Checker Tools Worth Using

The padlock shows in the address bar, so HTTPS is done. Except the site still answers on port 80, one stylesheet loads over http://, and there is no HSTS header — so the first request a returning visitor makes is still in the clear.

“Do we have a certificate” and “is HTTPS actually enforced” are different questions, and only the first one is easy. The second involves the redirect chain, the HSTS policy and every subresource the page pulls in, which is why several different tools exist and why no single one covers all of it.

How to judge an HTTPS checker

Does it follow the whole redirect chain? http://example.com → https://example.com in one hop is right. Going via http://www.example.com first means a plain-text hop that a network attacker can intercept.

Does it read the HSTS header properly? max-age, includeSubDomains and preload each mean something specific, and a header that is present but weak reads as a pass in shallow tools.

Does it look inside the page? A perfect certificate and a script loading over HTTP still produces a broken padlock. Mixed content is a page-level problem, not a server one.

What is it not checking? The honest tools tell you. Certificate chain, cipher suites and revocation are separate concerns from redirect and header behaviour.

The comparison

Facts checked August 2026; tools change their plans. Table covers only the 3 alternatives — our tool gets its own section below.

AppSecSanta SSL/TLS Checker

The most detailed on HSTS specifically. It examines public HTTP and HTTPS responses, parses the HSTS header down to max-age, includeSubDomains and the preload token, and looks at Certificate Transparency metadata plus a single TLSA lookup. It awards a label from A+ to F.

It is refreshingly clear about its own scope: the grade comes from their local configuration heuristic and is not an industry-standard TLS grade, and it explicitly does not assess protocol versions, cipher suites, the live certificate chain, hostname coverage, revocation or client compatibility. Free with no signup, rate-limited to 20 checks per hour per IP address — fine for a site or two, restrictive for an agency working through a client list.

ScanTower HTTP Security Checker

Focused on the question most people actually have: does HTTP reliably become HTTPS. It verifies the redirect works, analyses the complete redirect chain end to end, checks HTTPS enforcement across the site and flags protocol downgrade risks. No account, no credit card, instant results.

It presents itself as one layer of a larger scan — the fuller product adds checks for exposed secrets, malicious scripts and supply chain risks. For redirect behaviour alone, the free layer is the relevant part and it does that job directly.

Geekflare Mixed Content Test

The page-level counterpart to the other two. It scans an HTTPS page for resources still loading over plain HTTP, covering scripts, stylesheets, images, frames, media, forms, srcset values and inline CSS URLs. That breadth matters: mixed content hides in srcset attributes and CSS url() references far more often than in obvious <img> tags.

One documented limit is that it examines a bounded set of linked stylesheet URLs rather than following every stylesheet reference indefinitely, so a deeply nested import chain may not be fully traversed. Free to start with no credit card required.

HTTPS Checker

Ours covers the three questions together: whether HTTP redirects to HTTPS correctly, whether HSTS is set, and whether the page pulls in mixed content — with the actual header values shown rather than a pass/fail badge. Seeing max-age=0 for yourself is more useful than being told HSTS is “present”.

What it does not do: inspect the certificate itself. Expiry, chain validity, hostname coverage and cipher suites are a different examination, and if that is your question you want a dedicated TLS analyser. MDN’s page on Strict-Transport-Security is the reference for what the header’s directives actually do.

Which one to pick

• Tuning an HSTS policy before preloading — AppSecSanta, for the header detail.
• A redirect chain that behaves oddly — ScanTower.
• A padlock that will not go green — Geekflare’s mixed content scan.
• All three questions in one pass, with the header values — the tool below.

How to do it with HTTPS Checker

1. Open the HTTPS Checker and enter the domain, starting with the bare http:// form.
2. Check the redirect reaches HTTPS in one hop, without a plain-text stop along the way.
3. Read the HSTS header values — a long max-age with includeSubDomains is the goal.
4. Fix any mixed content before worrying about preload.

The walkthrough is in how to check a site’s HTTPS setup properly. Other security tools are in the tools directory.

You might also need

HSTS is one of several headers doing this kind of work. The Security Headers Explainer covers what the rest of them are for and which ones you actually need.

When a redirect is going somewhere unexpected, the Redirect Chain Explainer shows each hop and why it happened.

Frequently asked questions

Is there a free HTTPS checker that doesn’t need an account?

All four here are free and none require an account. AppSecSanta rate-limits to 20 checks an hour per IP; the others do not publish a comparable cap.

What is HSTS and do I need it?

It is a header telling browsers to use HTTPS for your domain for a set period, so a returning visitor never makes that first plain-text request. You want it, but set a short max-age first — a long policy on a misconfigured site locks visitors out of it.

Why does my padlock show a warning when I have a valid certificate?

Almost always mixed content: the page itself is served over HTTPS but something inside it — a script, a stylesheet, an image — loads over HTTP. The certificate is fine; the page is not.

Final thought

Test from http://, not https://. Everyone checks the secure URL, it works, and the insecure hop that actually exposes visitors goes unnoticed for another year.

Try the free HTTPS Checker