Free SSL Checker

What is SSL, and what does HTTPS mean?

SSL is the old name for the technology that makes the connection between a visitor's browser and your website private. Its proper name today is TLS, but almost everyone still says “SSL”. When it is set up, your address starts with https:// instead of http://, and the browser shows a padlock or a settings icon next to it.

To make that private connection, your website needs a certificate: a small file, issued by a certificate authority, that proves the site really is yourbusiness.com. Certificates end after a set time (often 90 days or less for the free ones) and have to be renewed. Website builders like Wix and Squarespace, most web hosts, and Cloudflare get and renew free certificates for you automatically.

A padlock means the connection is private. It does not mean the business behind the site is trustworthy, and it does not protect a site from being hacked. It is the basic level every website is expected to have.

Why does Chrome say “Not secure” on my website?

• The page opened on http://. Someone typed or clicked the plain address, and your site didn't move them to https://. This is the most common reason.
• There is no working certificate. It ended and wasn't renewed, it was made for a different name (for example only for www.yourbusiness.com, not yourbusiness.com), or the domain was moved and the new host hasn't issued one yet. Browsers then show a full-page warning instead of your site.
• The page loads something insecure. An image, script, video or embedded form on the page still uses an http:// address (this is called mixed content). Browsers block or hide those items, and some show the page as not fully secure.
• A form sends to http://. If a contact or booking form submits to an http:// address, browsers warn visitors before they send it.

The checker above looks for each of these and tells you which one applies.

How to read your results

• Secure connection (HTTPS): our checker opened your page on https:// and accepted its certificate, the same kind of check a browser makes. If it couldn't, the certificate is usually missing, ended, or made for a different name.
• http:// moves visitors to https://: we open the plain http:// address and follow where it leads. It should end on https://.
• The www or non-www address: people type your address both ways. Both should open on https://, and one should move visitors to the other.
• Certificate details: who issued it, when it ends, and which names it covers, from public certificate logs. If it ends soon and isn't being renewed, visitors will soon see a warning.
• Insecure items: scripts, style sheets, frames, images, media and forms in your page's HTML that use http://.
• HSTS: an optional setting that tells browsers to always use https:// for your site.

The verdict is Secure when the connection works and nothing needs fixing (there may still be suggestions), Problem found when at least one check failed, and Couldn't check when your site didn't answer us, so we can't say either way.

How to fix a certificate or HTTPS problem

Wix

Wix gives connected domains a certificate, but only once the domain is connected correctly. In your Wix account open Domains, click the Domain Actions icon next to your domain and choose Manage DNS Records to see the records. If your domain is with another company, it needs the records Wix shows you there (Wix's help article on SSL troubleshooting lists them). After a DNS change, allow up to 48 hours.

WordPress (and most web hosts)

1. Turn on the free certificate in your hosting account. In cPanel open SSL/TLS Status and run AutoSSL; in Plesk open SSL/TLS Certificates and choose Let's Encrypt. Other hosts have a “Free SSL” or “Let's Encrypt” switch. If you can't find it, ask your host's support to “turn on a free SSL certificate for my domain and www”.
2. Tell WordPress to use https. In Settings → General, change both WordPress Address (URL) and Site Address (URL) to start with https://, then click Save Changes. Do this only after the certificate works, or you may lock yourself out until the host fixes it.

Squarespace

Squarespace includes a free certificate for its own and connected domains. In Settings, find the SSL panel (under Developer Tools in recent versions; the settings search finds it too) and choose Secure. After connecting a new domain, issuing the certificate can take up to 72 hours.

Cloudflare

In your Cloudflare dashboard open SSL/TLS. Set the encryption mode to Full (strict) if your host has a certificate (it usually does). If visitors see “error 526”, your host's certificate is missing or ended: fix it at your host, as above. Cloudflare renews its own certificate for your domain automatically.

How to make http:// move visitors to https://

• Wix and Squarespace: they do this for you once the certificate is active. On Squarespace, the SSL panel set to Secure does it.
• Cloudflare: SSL/TLS → Edge Certificates → Always Use HTTPS, turned on.
• cPanel: Domains, then switch on Force HTTPS Redirect for your domain.
• Plesk: in Hosting Settings, tick the permanent 301 redirect from HTTP to HTTPS.
• WordPress on other hosts: look for “Force HTTPS” in your hosting dashboard, or ask your host to add the redirect. An SSL plugin can also do it.

“Too many redirects” after turning on HTTPS

This usually means two settings fight each other: one sends visitors to https://, the other sends them back. The most common cause is Cloudflare's SSL mode set to Flexible while your host or WordPress also forces https. Set Cloudflare to Full (strict) (or Full if your host has no certificate yet), and keep only one “force HTTPS” setting turned on.

Make both www and non-www work on https

Your certificate has to cover both names, and both have to point at your site. Pick one as your main address; the other should move visitors to it.

• Wix: a connected domain needs both records Wix lists: the A record for the domain itself and the CNAME record for www (see Domains → Domain Actions → Manage DNS Records).
• Hosting with cPanel or Plesk: make sure both names point at your host in your DNS, then run AutoSSL (or reissue the Let's Encrypt certificate and tick the www name).
• Squarespace: connect the domain through Squarespace's domain settings; it sets up both names when the domain's records are correct.
• Cloudflare: both the domain and www need a DNS record with the orange cloud (proxied) turned on.

How to fix insecure items (mixed content)

Each insecure item in your results shows its address. Change http:// to https:// where it is added, and check that the https:// address still works (open it in your browser). If it doesn't, the other website doesn't support https: host the image or file on your own site instead.

• Wix: insecure items usually come from embedded code. In the Editor, click the HTML element, click Edit Code and change http:// to https://, then Publish. Also check code added under your site's Custom Code settings.
• WordPress: old posts and settings can still hold http:// addresses after a move to https. A search-and-replace plugin (back up first) can change http://yourbusiness.com to https://yourbusiness.com everywhere. Also check theme options, widgets and page-builder settings.
• Squarespace: check code blocks and Code Injection for http:// addresses.
• Cloudflare: SSL/TLS → Edge Certificates → Automatic HTTPS Rewrites can change many of them for you; still fix the source when you can.

My certificate ends soon

Most certificates renew automatically well before they end, so a near date is usually fine. It is worth acting when the newest certificate is close to its end date and no newer one appears. Renewal usually fails because the domain's DNS records changed (for example after moving the domain or the site), or because a manually bought certificate wasn't renewed. Check that your domain still points at your website builder or host, run AutoSSL again in cPanel, or ask your host to renew it. Wix, Squarespace and Cloudflare renew theirs themselves when the domain is connected correctly.

Turning on HSTS (optional)

HSTS tells browsers “always use https:// for this site”, even if someone types http://. Turn it on only when https works everywhere on your site, including www, because browsers then refuse to open the site without it for as long as the setting says.

• Cloudflare: SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS). Start with a short time, such as one month.
• Squarespace: in the SSL panel choose HSTS Secure.
• WordPress and other hosts: some hosts have an HSTS switch; otherwise ask them to add the Strict-Transport-Security header, or use Cloudflare.
• Wix: we're not aware of an HSTS setting for site owners; the rest of this check matters more.

What this checker does, and its limits

• Opens the address you enter on https://, then the same address on plain http://, then your domain with or without www, following up to 5 redirects each, from our server.
• It can't see your certificate directly. Our checker runs on Cloudflare Workers, which refuse a certificate they don't accept but don't show it to us. So “Secure connection” means our checker accepted it; it doesn't name the exact fault when it couldn't.
• Certificate details come from public certificate logs. Certificate authorities publish every certificate they issue (Certificate Transparency). We read the newest current one listed for your address through crt.sh, a free public search of those logs. That is normally, but not always, the one your site uses. The logs are sometimes slow; then the result says it couldn't read the details, and the other checks still run.
• Reads the HTML of one page for insecure items. It doesn't run your site's scripts, so items that scripts add later aren't found.
• Checks from one place on the internet, not from your visitors' browsers. Very old phones and computers can reject certificates that modern ones accept.
• Introduces itself as FlatRateChatBot. Some sites block automated checks; then the result says so instead of guessing.
• Up to 60 checks a day from one connection, and 30 a day of the same website. No report is saved: we keep only the counters for these daily limits and anonymous usage counts.
• Also free: the Broken Link Checker tests every link on your pages.
• Also free: the Sitemap Generator makes an XML sitemap of your pages and checks the one you have.
• Also free: the Google Maps Embed Generator makes the code to show your business on a Google map on your website.
• Also free: the WhatsApp Link Generator makes WhatsApp, click-to-call and text links, website buttons and a QR code.
• Also free: the Google Review Link Generator turns your Google review link into a QR code, a printable sign and ready-to-send messages.
• Also free: the Website Down Checker checks from our server whether a website answers right now, and why not.
• Also free: the Redirect Checker shows every redirect a web address goes through, step by step.
• Also free: the Robots.txt Checker reads your robots.txt and shows whether it blocks Google, AI crawlers or your sitemap.
• Also free: the Robots.txt Generator makes a robots.txt file for your website and checks it as you type.
• Also free: the Website Accessibility Checker scans one page for common accessibility problems, like images without alt text and form fields without labels.
• Also free: the Meta Tag Checker shows the title, description and other tags Google reads on a page, with a search preview.
• Also free: the Open Graph Checker shows how a page will look when shared on Facebook, LinkedIn and X, and checks its og:image.

Questions