Web Security Checker
Check SSL certificate validity and HTTP security headers in a single lookup.
What are SSL certificates and security headers?
An SSL certificate encrypts the connection between your website and its visitors. Expired or misconfigured certificates cause browser warnings and SEO penalties.
HTTP security headers are directives sent by the server to the browser. They protect against common vulnerabilities such as clickjacking, MIME sniffing, and protocol downgrade attacks.
What does each header mean?
HSTS (Strict-Transport-Security)
Forces the browser to connect to this site over HTTPS only. Missing HSTS leaves the site vulnerable to protocol downgrade attacks.
CSP (Content-Security-Policy)
Defines which sources can load scripts, styles, and content. It is the strongest defense mechanism against XSS attacks.
X-Frame-Options
Controls whether the page can be displayed inside another site's iframe. Prevents clickjacking attacks.
X-Content-Type-Options
Prevents the browser from guessing the content type (MIME sniffing). Should be set to nosniff.
Referrer-Policy
Controls how much referrer information is sent to a destination site when a link is followed. Protects user privacy.
Permissions-Policy
Restricts access to browser APIs such as camera, microphone, and geolocation. Prevents unauthorized API use by third-party scripts.
Frequently asked questions
Your server may have port 443 closed or a firewall blocking external access. Some hosting providers also restrict SNI support.
Missing headers increase attack surface but don't necessarily mean an active vulnerability. Without HSTS, HTTP access remains possible; without CSP, XSS attacks are easier to carry out.
Let's Encrypt certificates need renewal every 90 days; commercial certificates are typically valid for 1 year. It's recommended to renew at least 30 days before expiry.
You can add them via .htaccess using Header set directives. Alternatively, use WordPress plugins like "HTTP Headers" or "Security Headers".
Need help improving your web security?
Contact KodSanat for SSL configuration, security headers, and DNS setup.