Web · SecuritySSL and security headers check
Check a website's SSL certificate expiry and its HTTP security headers (HSTS, CSP, X-Frame-Options and more) with a grade. Free, no sign-up.
✕
Grade Fexample.com · certificate 41 days left · 11 issue(s)
| Host | example.com |
|---|
| Grade | F |
|---|
| Certificate expires | 2026-12-25T22:56:35Z |
|---|
| Days left | 41 |
|---|
| Issuer | SSL Corporation |
|---|
| TLS | TLSv1.3 |
|---|
| Issues | - HIGH · content-security-policyContent-Security-Policy header is missing. Fix: Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; base-uri 'self'; object-src 'none'
- HIGH · strict-transport-securityStrict-Transport-Security header is missing. Fix: Strict-Transport-Security: max-age=31536000; includeSubDomains
- MEDIUM · tlsThe server still accepts TLSv1.0 and TLSv1.1. Fix: Disable TLS 1.0 and 1.1; allow TLS 1.2 and 1.3 only.
- MEDIUM · x-frame-optionsNo clickjacking protection: neither X-Frame-Options nor CSP frame-ancestors is set. Fix: X-Frame-Options: DENY (or Content-Security-Policy: frame-ancestors 'self')
- MEDIUM · https-redirectPlain http:// does not redirect to https://. Fix: Redirect every http:// request with a 301 to the https:// URL.
- MEDIUM · x-content-type-optionsX-Content-Type-Options is missing. Fix: X-Content-Type-Options: nosniff
- MEDIUM · referrer-policyReferrer-Policy header is missing. Fix: Referrer-Policy: strict-origin-when-cross-origin
- LOW · permissions-policyPermissions-Policy header is missing. Fix: Permissions-Policy: camera=(), microphone=(), geolocation=()
- LOW · cross-origin-embedder-policyCross-Origin-Embedder-Policy header is missing. Fix: Cross-Origin-Embedder-Policy: require-corp
- LOW · cross-origin-opener-policyCross-Origin-Opener-Policy header is missing. Fix: Cross-Origin-Opener-Policy: same-origin
- LOW · cross-origin-resource-policyCross-Origin-Resource-Policy header is missing. Fix: Cross-Origin-Resource-Policy: same-site
|
|---|
Example result for example.com.
Need this in bulk or inside your app?
The same data as an API: JSON, lists of hundreds of items, history and "only new" monitoring. Pay per use, free trial on the markets.
Example API request
curl -X POST https://radarbg.com/x402/security-headers-ssl-check \
-H "Content-Type: application/json" \
-d '{"hosts": ["example.com"]}'
# answers 402 with the price; any x402 client pays per call in USDC on BaseQuestions
What is checked?
TLS certificate (issuer, expiry, hostname) and the main security headers.
Can it warn me before expiry?
Yes, the API can watch many sites and report certificates about to expire.
Does it scan for vulnerabilities?
No, only certificate and headers. Our Security Scan API matches software versions to CVEs.
More free tools