Free tool
SSL certificate checker
Check your website's HTTPS: a trusted certificate that matches your domain, the HTTP-to-HTTPS redirect, HSTS and CAA records.
What you get out of it
- Confirm visitors get a trusted certificate that matches your domain.
- Check that plain HTTP redirects to HTTPS and that HSTS is on.
- On Starter and up, DomainGuard reads the certificate off your server every day: its expiry date, chain and TLS versions.
A one-off check is a snapshot. Add the domain to DomainGuard and it is watched: its uptime every five minutes on every plan, and on Starter and up every check here again each day, with an alert in the app when something important changes. What DomainGuard watches
What it checks
SSL/TLS & Website
- Website reachability checkWhether your website answered at all. If this fails, most other website checks could not run.
- HTTPS connection checkWhether your site completes a secure HTTPS connection with a certificate browsers trust.
- SSL certificate checkThe certificate your website presents: who issued it, which names it covers, and when it expires.
- Certificate expiry checkAn expired SSL certificate turns your website into a browser warning. We check how many days yours has left.
- Certificate trust and chain checkWhether browsers trust the certificate: issued by a real authority, served with its full chain, and not revoked.
- Certificate name checkThe certificate has to name the exact hostname a visitor types. If it names something else, browsers refuse it.
- Certificate key and signature checkWhether your certificate uses a key and signature strong enough for today's browsers.
- TLS version checkWhether your server still accepts retired encryption (TLS 1.0 and 1.1) and whether it offers the current one (TLS 1.3).
- CAA record checkA CAA record names the certificate authorities allowed to issue certificates for your domain, and blocks the rest.
- HTTP to HTTPS redirect checkVisitors who type your address without https:// should be sent to the secure version automatically.
- HTTP status checkThe status code your homepage answers with. Anything but a success means visitors and search engines are not seeing your site.
- Response time checkHow long your homepage takes to answer. Under a second passes, one to three seconds is a warning, and over three seconds fails.
- Mixed content checkAn HTTPS page that loads images or scripts over plain HTTP. Browsers block them or mark the page as not fully secure.
- Parked domain checkWhether your domain is showing a registrar's parking page (ads, "this domain may be for sale") instead of your website.
- Cross-domain redirect checkYour domain sends visitors to a different domain. Fine if intended; worth knowing if not.
Other free checkers
- Website & Domain ReportOne report on your email security, DNS, SSL, security headers, cookies, registration and reputation, with a link you can share with your IT provider.
- Email Security CheckerCheck SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT for your domain and find out whether your email can be spoofed or will land in spam.
- SPF CheckerCheck your domain's SPF record: whether it is valid, whether it stays under the 10-lookup limit, and how strictly it treats unlisted senders.
- DMARC CheckerCheck whether your domain has a DMARC record, what its policy is, and whether it protects your customers from email sent in your name.
- DKIM CheckerCheck whether your domain publishes DKIM keys for common mail providers, so receivers can verify your email is really from you.
- Security Headers CheckerCheck your website's HTTP security headers (CSP, HSTS, X-Frame-Options and more) and cookie flags, with a fix for each one missing.
- DNS CheckerCheck your domain's nameservers, redundancy, MX records and CAA records, and find the DNS problems that take websites and email offline.
- Blacklist CheckerCheck whether the servers behind your domain are listed on the SpamCop and Barracuda blocklists, which some mail providers use to reject email.
- Domain Expiration CheckerCheck when your domain expires, who it is registered with, how old it is and who hosts the website, so a lapsed renewal never takes your site and email down.