Blog
How-to guides and articles you can reference when the checker finds an issue. Step-by-step for Nginx, Apache, Cloudflare, WordPress, and more.
GitHub Actions Security Headers Check (Fail the PR)
Add a GitHub Actions workflow that fails the PR when security headers fall below a grade — free httpsornot API, no key, headersMinGrade → HTTP 422.
Read moreSecurityHeaders.com API Discontinued — Migrate Your CI in Minutes
api.securityheaders.com was discontinued in April 2026. Replace it with a free headersMinGrade check — curl, field map, and a copy-paste GitHub Actions workflow.
Read moreSSL Monitoring and Alerts: What We Watch and How to Get Notified
Continuous HTTPS monitoring: grade changes, redirects, headers, certificate expiry, Certificate Transparency, email and Slack/webhook alerts. Free and paid plans.
Read moreSecure Cookie Flags: Secure, HttpOnly, and SameSite
Set-Cookie flags Secure, HttpOnly, and SameSite protect session cookies. How to set them and how our HTTPS checker reports them.
Read moreWhat Is DNSSEC and How to Enable It
DNSSEC signs DNS answers so resolvers can detect tampering. Enable it at your DNS host and registrar, then verify with our checker.
Read moreHow to Improve Your SSL/HTTPS Grade
Map each factor in your SSL grade (A+ to F) to a fix: HTTPS, redirect, certificate, modern TLS, HSTS, and security headers — with links to step-by-step guides.
Read moreHow to Disable TLS 1.0 and 1.1 (Nginx, Apache, Cloudflare)
TLS 1.0 and 1.1 are obsolete. Disable them so clients use TLS 1.2 or 1.3 — step-by-step for Nginx, Apache, and Cloudflare.
Read moreYour Deploy Dropped CSP — and Nobody Noticed Until Monitoring Did
A release removes Content-Security-Policy, the site still works, and only a headers monitor or CI policy catches it. How to wire alerts and fail-the-PR checks with httpsornot.
Read moreWhat Is the DNS HTTPS Record (Type 65) and How Does It Work?
The DNS HTTPS record (type 65, RFC 9460) lets browsers discover ALPN protocols and ECH config before connecting. Cloudflare adds it automatically — here's what it is and what it contains.
Read moreWhat Is OCSP Stapling and How to Enable It (Nginx, Apache, Cloudflare)
OCSP stapling lets your server attach a fresh revocation proof to the TLS handshake. Faster, more private, one less round-trip to the CA — and three lines of config in Nginx or Apache.
Read moreHTTP-01 vs DNS-01 vs TLS-ALPN-01: Which ACME Challenge Should You Use?
Let's Encrypt and every modern ACME CA support three validation methods. Wildcards force DNS-01, port-80-closed sites need TLS-ALPN-01, everything else can stick with HTTP-01. A decision guide with certbot examples.
Read moreShort Lived TLS Certificates: What the 47 Day Future Means for Your Site
The CA/Browser Forum approved a phased reduction of TLS certificate lifetimes to 47 days by 2029. What changes for renewals, automation, and monitoring.
Read moreHSTS Preload: How to Submit Your Site and How to Safely Remove It
A practical guide to Strict Transport Security preload: header format, subdomain requirements, how to submit at hstspreload.org, and the slow path to remove a domain.
Read moreALPN vs Alt Svc: Why HTTP/2 and HTTP/3 Detection Tools Disagree
HTTP/2 is negotiated in TLS via ALPN. HTTP/3 is advertised via the Alt Svc header. That is why checkers return different answers, and how to confirm support reliably.
Read moreCertificate Chain Errors: How to Fix an Incomplete SSL Chain
Missing intermediate certificates cause ERR_CERT_AUTHORITY_INVALID. Fix fullchain.pem, Nginx/Apache config, and verify with openssl or our SSL checker.
Read moreWhat Is a CAA Record and Why Does It Matter for SSL?
CAA DNS records restrict which certificate authorities can issue TLS certs for your domain. Tags, examples, and how our checker surfaces CAA.
Read more301 vs 302 vs 307 Redirects: Which Status Code Should You Use?
Permanent vs temporary redirects, SEO, caching, and when to use 301, 302, 307, or 308—including HTTP→HTTPS. Verify chains with our redirect checker.
Read moreBulk SSL Checker: How to Check Multiple Domains at Once
Check SSL and HTTPS for up to 10 domains in one go. Get grades, redirect chains, and certificates. Export to PDF or JSON, share report links. No signup.
Read moreHTTP/2 and HTTP/3: What They Are and How to Enable Them
HTTP/2 and HTTP/3 speed up your site with multiplexing and QUIC. Here's what they do and how to turn them on in Nginx and Cloudflare.
Read moreWhat Is Mixed Content and How to Fix It
Your page is HTTPS but some images, scripts or styles still load over HTTP. Browsers block them or warn. Here's how to find and fix mixed content on your site.
Read moreHTTPS and SEO: Does It Affect Rankings?
Google treats HTTPS as a ranking signal. See what that means in practice, what to fix, and how to check your site's HTTPS setup for free.
Read moreSecurity Headers: What They Are and How to Set Them
Guide to HTTP security headers: HSTS, Content-Security-Policy, X-Frame-Options, and more. How to add them in Nginx, Apache, and Cloudflare.
Read moreHow to Fix a Redirect Loop
Step-by-step guide to fix redirect loops (ERR_TOO_MANY_REDIRECTS): trace the loop, fix conflicting rules in Nginx, Apache, Cloudflare.
Read moreHow to Fix SSL Certificate Errors
Step-by-step guide to fix SSL certificate errors: renewal (Let's Encrypt, certbot), certificate chain, Nginx, Apache, cPanel, Cloudflare.
Read moreHow to Fix HTTP to HTTPS Redirect
Step-by-step guide to set up a 301 redirect from HTTP to HTTPS on Nginx, Apache, Cloudflare, and WordPress.
Read moreHow to Install Nginx, Certbot, and SSL on Ubuntu 24
Step-by-step guide: install Nginx and Certbot on Ubuntu 24, configure a domain with Let's Encrypt SSL, and set up HTTPS redirect.
Read more
Get security tips & updates
Occasional emails on HTTPS, SSL, and security headers. No spam, unsubscribe anytime.