HTTPS protects data in transit between a browser and a server. It does not establish that an application’s private logic is secure.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Checks that the certificate is trusted, unexpired and issued for the scanned domain.
Renew the certificate and install the full chain. Most hosts can issue a free Let's Encrypt certificate automatically.
Requests the site over plain HTTP and checks that it redirects to HTTPS.
Redirect every HTTP request to HTTPS with a 301.
Looks for scripts, iframes and stylesheets loaded over plain HTTP on an HTTPS page.
Load every script, stylesheet and iframe over https://. Update hard-coded http:// URLs in templates and settings.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology