DOpen Data Tools
Web · Security

SSL and security headers check

Check a website's SSL certificate expiry and its HTTP security headers (HSTS, CSP, X-Frame-Options and more) with a grade. Free, no sign-up.

Try: github.comexample.comwikipedia.org
✕
Grade Fwikipedia.org · certificate 49 days left · 10 issue(s)
Hostwikipedia.org
GradeF
Certificate expires2027-01-02T18:34:50Z
Days left49
IssuerLet's Encrypt
TLSTLSv1.3
Issues
  • HIGH · content-security-policyContent-Security-Policy header is missing. Fix: Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; base-uri 'self'; object-src 'none'
  • MEDIUM · x-frame-optionsNo clickjacking protection: neither X-Frame-Options nor CSP frame-ancestors is set. Fix: X-Frame-Options: DENY (or Content-Security-Policy: frame-ancestors 'self')
  • MEDIUM · x-content-type-optionsX-Content-Type-Options is missing. Fix: X-Content-Type-Options: nosniff
  • MEDIUM · referrer-policyReferrer-Policy header is missing. Fix: Referrer-Policy: strict-origin-when-cross-origin
  • LOW · permissions-policyPermissions-Policy header is missing. Fix: Permissions-Policy: camera=(), microphone=(), geolocation=()
  • LOW · set-cookie2 of 5 cookies have no HttpOnly flag. Fix: Add '; HttpOnly' to cookies that JavaScript does not need to read.
  • LOW · cross-origin-embedder-policyCross-Origin-Embedder-Policy header is missing. Fix: Cross-Origin-Embedder-Policy: require-corp
  • LOW · cross-origin-opener-policyCross-Origin-Opener-Policy header is missing. Fix: Cross-Origin-Opener-Policy: same-origin
  • LOW · cross-origin-resource-policyCross-Origin-Resource-Policy header is missing. Fix: Cross-Origin-Resource-Policy: same-site
  • LOW · set-cookie3 of 5 cookies have no SameSite attribute. Fix: Add '; SameSite=Lax' (or Strict) to every Set-Cookie header.

Need this in bulk or inside your app?

The same data as an API: JSON, lists of hundreds of items, history and "only new" monitoring. Pay per use, free trial on the markets.

API.market →Apify →x402 for AI agents →
Example API request
curl -X POST https://radarbg.com/x402/security-headers-ssl-check \
  -H "Content-Type: application/json" \
  -d '{"hosts": ["example.com"]}'
# answers 402 with the price; any x402 client pays per call in USDC on Base

Questions

What is checked?

TLS certificate (issuer, expiry, hostname) and the main security headers.

Can it warn me before expiry?

Yes, the API can watch many sites and report certificates about to expire.

Does it scan for vulnerabilities?

No, only certificate and headers. Our Security Scan API matches software versions to CVEs.

More free tools

EU VAT number checkHS code lookupVIN recall checkMortgage rates todayCentral bank interest ratesUS gas prices by stateUS Treasury yield curveDMARC, SPF and MX checkerLink preview checker