Online Tool Store
HTTPS Checker
Check whether a site redirects HTTP to HTTPS correctly, sets HSTS, and avoids mixed content, with the header values that matter.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Security & Privacy
HTTPS Checker
Frontend preview — no upload or external service.
Findings
http://example.com → 301 → https://example.com, single hop. HSTS present with max-age 31536000 and includeSubDomains. One mixed-content image loaded over http.
How the HTTPS Checker works
- Enter the URL, ideally the apex domain rather than a deep page.
- Check that HTTP redirects to HTTPS in one hop, not through a chain.
- Fix any mixed content before enabling HSTS preload, since preload is difficult to reverse.
FAQ
Why does a redirect chain matter?
Each extra hop adds a round trip and a moment where the request is still in plaintext. http → https → www.https is two chances to be intercepted where one would do.
What does HSTS actually do?
It tells browsers to use HTTPS for this host for a set period, so later visits never issue a plaintext request at all. The trade-off is that the setting is hard to undo before max-age expires.
What is mixed content?
A secure page loading a subresource over plain HTTP. Browsers block active mixed content outright and often flag passive content, which undermines the padlock the page just earned.
How we compare
| Feature | Online Tool Store | A command-line tool | A paid audit service |
|---|---|---|---|
| Redirect chain analysis | ✓ | Manual | ✓ |
| HSTS values explained | ✓ | ✗ | Sometimes |
| No account needed | ✓ | ✓ | ✗ |
| Full certificate audit | ✗ | ✗ | ✓ |
HTTPS Checker looks at redirects, HSTS and mixed content — the configuration layer, not the certificate itself, which needs a different check.