Free tool
HTTPS & HSTS Checker
HTTPS is only half the job: without HSTS a first request can still be downgraded, and a single resource loaded over http:// undoes the encryption on that page. This checks both in seconds.
What this checks
- ✓No HSTS (or lifetime too short) Security header
- ✓Resources loaded over unencrypted connections Art. 32 GDPR
How the check works
We fetch your page over HTTPS and check the Strict-Transport-Security (HSTS) header, then look for scripts, images or styles loaded over plain http:// on the same page. Passive, read-only, nothing stored.
Common questions
Isn't HTTPS enough on its own?
Not quite. HSTS tells browsers to always use HTTPS, closing the gap where a first plain-HTTP request could be intercepted and downgraded — the classic coffee-shop attack. Without it, HTTPS is opt-in per request.
What is mixed content?
An HTTPS page that loads some resource over http://. That resource can be read or altered in transit, and browsers may block or flag it. It's a technical-measures gap under Art. 32 GDPR.
How do I fix these?
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once your whole site is on HTTPS, and change any http:// resource URLs to https:// (your browser console lists them).
All free tools · every check explained · run the full 15-point check