Question 1

What does HTTP → HTTPS redirect mean?

Accepted Answer

When someone types your site with http:// or an old link points there, the server sends them to the https:// version instead. That way all traffic ends up encrypted. A 301 (permanent) redirect is the right choice: it tells browsers and search engines that HTTPS is the real URL, so they don't keep trying HTTP.

Question 2

What is mixed content and why does it matter?

Accepted Answer

Your page is served over HTTPS, but some images, scripts, or styles load over plain HTTP. That's mixed content. Browsers block or warn because it undermines the lock icon—part of the page is still exposed. The checker can list HTTP resources on your site; fix them by switching those URLs to HTTPS or relative paths.

Question 3

What's the difference between SSL and TLS?

Accepted Answer

TLS (Transport Layer Security) is the current standard; SSL (Secure Sockets Layer) was the older name. Browsers and servers use TLS today, but people still say "SSL" for the padlock and "SSL certificate." When we say "SSL grade" or "SSL certificate," we mean the same thing: the encryption and certificate that make HTTPS work.

Question 4

Is the tool really free? Do I need to sign up?

Accepted Answer

Yes. The checker is free and you don't need an account or signup. Enter one domain or several (up to 10, comma or space separated) for a bulk check. You get the full report—redirect chain, certificate, grade, headers, mixed content. You can export to PDF or JSON and share the results link. No registration required.

Question 5

Do you store my domain or check results?

Accepted Answer

When a check succeeds (the domain is reachable over HTTPS and not rate-limited), we store the domain and result so you get a stable report page you can share at /report/{domain}. We don't tie stored reports to you personally. We don't store results for unreachable domains or when the server returns 429. Server logs may temporarily hold request data for operations and security; we don't use them to identify you or build profiles. See our Privacy page for full details.

Question 6

What are security headers (HSTS, CSP) and why do they matter?

Accepted Answer

Security headers tell the browser how to treat your site—force HTTPS next time (HSTS), block unsafe scripts (Content-Security-Policy), control iframe embedding (X-Frame-Options), and more. They're recommended by OWASP and help prevent XSS, clickjacking, and similar issues. Content-Security-Policy (CSP) is required for both our security headers score and for an A+ grade—without it you cannot get the full 5 points or reach A+. The report also shows cookie security (Set-Cookie flags) and server-disclosure headers for awareness; these don't affect the grade. See the Security Headers page for a full breakdown and what we check.

Question 7

What is CAA and why does it matter?

Accepted Answer

CAA (Certificate Authority Authorization) is a DNS record that specifies which Certificate Authorities (CAs) are allowed to issue certificates for your domain. Without CAA, any CA can issue a cert for your domain. Adding CAA lets you restrict issuance to trusted providers (e.g. Let's Encrypt, DigiCert), reducing the risk of misissuance. Our checker reports whether CAA is configured and which issuers are allowed.

Question 8

What is DNSSEC and why does it matter?

Accepted Answer

DNSSEC (DNS Security Extensions) cryptographically signs DNS records so resolvers can verify they haven't been tampered with. It protects against DNS spoofing and cache poisoning. Our checker uses Google Public DNS to verify if your apex domain's DNS is DNSSEC-validated. If it shows 'Validated', your DNS responses are cryptographically authenticated.

Question 9

Does the checker test HTTP/3?

Accepted Answer

Yes. We check whether your server advertises HTTP/3 (QUIC) via the Alt-Svc header. If it does, the report shows "HTTP/3: Advertised" and the raw Alt-Svc value; it's also included in the PDF export. HTTP/3 uses QUIC over UDP and can improve performance; many CDNs and hosts (e.g. Cloudflare) enable it by default.

Question 10

How is the SSL Grade calculated?

Accepted Answer

We score eight factors on a 100-point scale: HTTPS works (25 pts), HTTP to HTTPS redirect (20), valid certificate (20), certificate not expiring within 14 days (10), modern TLS — no 1.0/1.1 (10), redirect chain of 3 hops or less (5), HSTS enabled (5), and security headers including CSP (5). Grades: 97+ A+, 88+ A, 85+ A-, 76+ B+, 66+ B, 46+ C, below 46 F. In practice, scores are always multiples of 5 (all factors are 5 or 10 pts), so A+ = 100, A = 90 or 95, A- = 85, B+ = 80. A+ also requires HSTS preload (on the list or eligible), Content-Security-Policy, and TLS 1.3. Disabling TLS 1.0 and 1.1 earns the Modern TLS factor (+10 pts). Response time is shown in the report but does not affect the grade. Security headers count only when values are correct (e.g. X-Content-Type-Options must be nosniff; unsafe Referrer-Policy values do not count). The report lists exactly what you're missing.

Question 11

Should I use 301 or 302 redirects for HTTPS?

Accepted Answer

Stick with 301 (permanent). It tells search engines "HTTPS is the real URL," so they consolidate ranking signals there. A 302 says "this might change," so they may keep indexing both versions and your SEO gets split.

Question 12

How do I get an SSL grade A+?

Accepted Answer

Score 97 or more out of 100 plus: valid cert, HTTP to HTTPS redirect, HSTS with preload (on the preload list or eligible for submission), Content-Security-Policy, and TLS 1.3. Keep the redirect chain to 3 hops or less and renew the certificate before it enters the 14-day expiry window. Disable TLS 1.0 and 1.1 to earn the Modern TLS factor (+10 pts). Run the checker and it'll show your grade plus exactly what to improve.

Question 13

Why is my SSL certificate showing as invalid?

Accepted Answer

Usually it's one of these: the cert has expired, it was issued for a different domain, the chain is incomplete (missing intermediates), or it's self-signed and the browser doesn't trust it. Run your domain through the checker to see the exact status and expiry date.

Question 14

Why does the checker show a different result than when I open my site in the browser?

Accepted Answer

Common reasons: the checker runs from our servers (different location or network than yours), so you might hit a different CDN or server. Firewalls, bot protection, or geo-blocking can block or alter our request. Caching or a different User-Agent can also change behavior. If your browser shows HTTPS and the checker doesn't, check from another network or try the checker again later.

Frequently Asked Questions

General

How it works

Results interpretation

Troubleshooting