Free SSL checker
See when your SSL certificate expires and why your website says "Not secure". Also checks that http:// sends people to https://, and finds anything on the page still loading over http://.
We only read what any browser can see. Nothing on your site changes.
Checking your certificate…
What to fix first
Worst first. Each one says what it means for your visitors and how to fix it.
Your certificate
The most recent unexpired certificate issued for your address, from the public Certificate Transparency logs.
What happens when someone types http://
Each step your site takes before the visitor lands.
Get help with what we found
Want us to fix this for you?
Tell us what the tool found and we will tell you what it takes to fix it. The first call is free.
Get tips like these by email
Practical advice on getting found, getting faster and getting more enquiries, plus news and offers about WPfoss products. No more than once a fortnight, and one click to leave.
Optional. You do not need to sign up to see your results.
Want us to fix this for you? The first call is free.
What "Not secure" costs a business website
The padlock tells visitors that what they type into your site, a phone number on a contact form or card details at checkout, travels encrypted. When it is missing, browsers say so: Chrome shows "Not secure" next to your address, and a broken or expired certificate gets a full-page warning before anyone sees your site.
Most problems we find on Kenyan business websites are not missing certificates. They are small things around them:
- Automatic renewal that stopped. Free certificates usually last 90 days. When a hosting change or a DNS move breaks renewal, the site works for weeks, then every visitor gets a warning on the same day.
- http:// that never redirects. The certificate works, but anyone who types your address without https, or clicks an old link, lands on the "Not secure" version.
- Mixed content. An https page that still loads an old logo, slider script or font over http://. Browsers block the scripts, so parts of the page silently break.
- The www version left out. The certificate covers yourbusiness.co.ke but not www.yourbusiness.co.ke, so half your visitors see a warning.
All four are quick to fix once you know they are there. If you would rather we fixed them, talk to us: our website maintenance plans include security monitoring and uptime checks every 5 minutes, and we design and build business websites from scratch. Want the rest of your site's protection checked? Try our security headers checker.
Questions people ask
Why does my site say "Not secure"?
Either the page is served over http:// instead of https://, or an https:// page loads something (an image, a script, a font) over http://. Browsers show "Not secure" for the first and may drop the padlock or block parts of the page for the second. This checker tests both.
What happens when an SSL certificate expires?
Every visitor gets a full-page warning such as "Your connection is not private" before they see your site, and most leave. Free certificates usually last 90 days and normally renew themselves; when renewal breaks, nobody notices until the warning appears.
Is a free SSL certificate good enough for a business site?
Yes, for most business websites. Free certificates from Let's Encrypt or Google Trust Services give the same encryption and the same padlock as paid ones. What matters is that they renew automatically.
Where do the certificate dates come from?
Every publicly trusted certificate is recorded in public Certificate Transparency logs. We read the most recent unexpired certificate issued for your address from those logs, through Cert Spotter. That is almost always the one your server uses; if your https:// fails while a valid certificate exists, we say so.
Do you keep my data?
We keep the address you checked and a summary of the result, so we can improve the tool. You do not need to give us your name or email. See our privacy policy.