DOpen Data Tools
Web · Security

SSL and security headers check

Check a website's SSL certificate expiry and its HTTP security headers (HSTS, CSP, X-Frame-Options and more) with a grade. Free, no sign-up.

Try: github.comexample.comwikipedia.org
✕
Grade Fexample.com · certificate 41 days left · 11 issue(s)
Hostexample.com
GradeF
Certificate expires2026-12-25T22:56:35Z
Days left41
IssuerSSL Corporation
TLSTLSv1.3
Issues
  • HIGH · content-security-policyContent-Security-Policy header is missing. Fix: Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; base-uri 'self'; object-src 'none'
  • HIGH · strict-transport-securityStrict-Transport-Security header is missing. Fix: Strict-Transport-Security: max-age=31536000; includeSubDomains
  • MEDIUM · tlsThe server still accepts TLSv1.0 and TLSv1.1. Fix: Disable TLS 1.0 and 1.1; allow TLS 1.2 and 1.3 only.
  • MEDIUM · x-frame-optionsNo clickjacking protection: neither X-Frame-Options nor CSP frame-ancestors is set. Fix: X-Frame-Options: DENY (or Content-Security-Policy: frame-ancestors 'self')
  • MEDIUM · https-redirectPlain http:// does not redirect to https://. Fix: Redirect every http:// request with a 301 to the https:// URL.
  • MEDIUM · x-content-type-optionsX-Content-Type-Options is missing. Fix: X-Content-Type-Options: nosniff
  • MEDIUM · referrer-policyReferrer-Policy header is missing. Fix: Referrer-Policy: strict-origin-when-cross-origin
  • LOW · permissions-policyPermissions-Policy header is missing. Fix: Permissions-Policy: camera=(), microphone=(), geolocation=()
  • LOW · cross-origin-embedder-policyCross-Origin-Embedder-Policy header is missing. Fix: Cross-Origin-Embedder-Policy: require-corp
  • LOW · cross-origin-opener-policyCross-Origin-Opener-Policy header is missing. Fix: Cross-Origin-Opener-Policy: same-origin
  • LOW · cross-origin-resource-policyCross-Origin-Resource-Policy header is missing. Fix: Cross-Origin-Resource-Policy: same-site

Need this in bulk or inside your app?

The same data as an API: JSON, lists of hundreds of items, history and "only new" monitoring. Pay per use, free trial on the markets.

API.market →Apify →x402 for AI agents →
Example API request
curl -X POST https://radarbg.com/x402/security-headers-ssl-check \
  -H "Content-Type: application/json" \
  -d '{"hosts": ["example.com"]}'
# answers 402 with the price; any x402 client pays per call in USDC on Base

Questions

What is checked?

TLS certificate (issuer, expiry, hostname) and the main security headers.

Can it warn me before expiry?

Yes, the API can watch many sites and report certificates about to expire.

Does it scan for vulnerabilities?

No, only certificate and headers. Our Security Scan API matches software versions to CVEs.

More free tools

EU VAT number checkHS code lookupVIN recall checkMortgage rates todayCentral bank interest ratesUS gas prices by stateUS Treasury yield curveDMARC, SPF and MX checkerLink preview checker