SSL Certificate & Security Checker

Connects to a live site and inspects the actual certificate, negotiated TLS version, cipher suite, and the full set of HTTP security headers — then rolls it all into an A+ to F grade. Built for checking a certificate install after a renewal, hardening a site's headers, or auditing something you've inherited and don't fully trust yet.

What actually gets checked

• Certificate — subject, issuer, root CA, validity window, days to expiry, SANs, serial number, SHA-256 fingerprint
• TLS protocol — whether the connection negotiated TLS 1.3 or fell back to 1.2, and which cipher suite it landed on
• HSTS — present or not, and whether max-age, includeSubDomains and preload are actually set correctly
• Content-Security-Policy — present or missing, the header doing most of the real work against XSS
• X-Frame-Options — whether the site can be embedded in someone else's iframe for clickjacking
• Server disclosure — whether the server is leaking version information that makes an attacker's reconnaissance easier for no benefit to you
• Everything else — Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, all the headers people tend to configure once and never revisit

How the grade actually adds up

It's a 100-point scale. Working HTTPS with a valid certificate is the foundation, worth 30 points on its own. TLS 1.3 adds 10, HSTS adds 15, CSP adds 10, X-Frame-Options adds 10, and the remaining headers fill out the rest. 90+ is A+, 75+ is A, 60+ B, 45+ C, 25+ D — below that, there's real, actionable work to do, not just polish.

What the grade is actually telling you

This isn't a vanity score — every point maps to a specific, fixable configuration gap. A B-grade site with a valid cert and working HTTPS but no CSP and no HSTS is functionally secure for basic browsing but still leaves real attack surface open that a few header changes would close, usually without touching application code at all.