Free web tools
Security tools.
Inspect a certificate, response headers, CORS and whether HTTP redirects to HTTPS.
Choose your next check.
Find the tool that matches your task.
SSL Checker
Inspect a certificate’s validity, hostname match and trust verification.
Open toolSecurity Headers Checker
Check your HTTP security headers. Understand the risks and get practical fixes.
Open toolHTTP Headers Checker
Inspect response headers, redirects and the context of an HTTP request.
Open toolHTTPS Redirect Checker
Follow HTTP to HTTPS redirects, each hop and the www variants that apply.
Open toolCORS Checker
Check whether an origin can read a response for a specific request scenario.
Open toolMixed Content Checker
Find insecure HTTP resources referenced by your HTTPS page.
Open toolWhich tool do you need?
Find a tool based on what you want to do.
Inspect a certificate
Check the issuer, dates and names on the certificate the site presents.
SSL CheckerReview response headers
See security headers such as CSP, HSTS and X-Frame-Options when the response includes them.
Security Headers CheckerCheck the HTTPS redirect
See whether HTTP and www variants redirect to HTTPS.
HTTPS Redirect CheckerLearn the basics
Understand these security checks.
Each tool reads a public response. It does not scan the server or certify that a site is secure.
Browse all toolsWhat each check looks at
SSL Checker reads the certificate chain. HTTP Headers lists response headers. Security Headers focuses on headers such as CSP and HSTS. Mixed Content looks for HTTP assets on an HTTPS page. HTTPS Redirect follows the HTTP to HTTPS hop. CORS Checker sends a cross-origin request and shows the access-control headers.
Why does the certificate matter?
The certificate is what the browser uses for HTTPS. SSL Checker shows the issuer, validity dates and names it could read. It does not prove the rest of the site is safe.
What are security headers?
Headers such as HSTS, Content-Security-Policy and X-Frame-Options tell the browser how to treat the response. Security Headers Checker reports the ones present on the response it received.
What is CORS?
Cross-origin requests depend on Access-Control response headers. CORS Checker shows the headers returned for the origin you enter, including an optional preflight.
Should HTTP redirect to HTTPS?
A redirect sends browsers from HTTP to HTTPS. HTTPS Redirect Checker follows that hop, including a www test when you leave that option on. HSTS is a separate header, visible in the header checks.
Need help with a security check?
Talk to our team about a certificate, header or HTTPS result. That is not a security audit engagement.