Inspect the live TLS certificate from one handshake — expiry, hostname coverage, trust chain, and negotiated protocol. It reads what the server presents; it does not test revocation or every cipher.
Ways to go deeper with this site:
It opens a single TLS handshake to the site and reads the certificate the server presents: its validity window and days remaining until expiry, whether it covers the requested hostname, whether it chains to a publicly trusted certificate authority (versus self-signed or an untrusted chain), and the TLS protocol version that was negotiated.
No. It reflects one handshake validated against the platform's built-in trust store. It does not check OCSP/CRL revocation status, negotiate or enumerate every cipher suite, cover every hostname on a multi-domain certificate, or fully reconstruct intermediate chains beyond what that handshake presents. Confirm consequential findings with a browser or a dedicated TLS scanner such as SSL Labs.
The target host is DNS-resolved and every resolved IP is validated against private, loopback, link-local, and cloud-metadata ranges before connecting. The handshake then connects to that already-validated public IP with SNI set to the hostname, so it never re-resolves DNS and cannot be redirected to an internal address between the check and the connection.
If the host is unreachable, does not serve HTTPS, or the handshake fails, the checker reports that the certificate was not inspected rather than claiming it is valid. No score is applied in that case — a missing test is never rendered as a clean result.
Security Headers
Review captured URL schemes, selected response-header presence, and explicit HTTP references in available HTML
Trust Checklist
Review crawl-visible HTTPS, policy, contact, identity, social-proof wording, and selected external-reference patterns
Privacy Signals
Detect public policy links, consent wording, and tracker references
Brand Trust
Report visible identity, policy, contact, and social-proof signals