What it checks
One scan covers the TLS certificate and its expiry, the certificate chain, which TLS protocol versions and ciphers are enabled, DNS and domain registration, email authentication (SPF, DMARC, DKIM), and the security headers the site sends. It also gives a direct readiness verdict against the CA/Browser Forum's certificate lifetime changes — 100 days from March 2027, 47 days from March 2029.
No signup, no cost, no history held against you
There's no account to create and nothing to pay. Enter a hostname, get a graded report in under 20 seconds, and share the result as a link — useful for an agency reporting back to a client, or a founder getting a second opinion from whoever manages their infrastructure.
Built with India's data protection law in mind
This is a public scanner that accepts hostnames from anyone, so it has to be careful by default: it only makes read-only TLS handshakes and HTTP requests, never anything that writes or authenticates. In line with the DPDP Act, the IP address making a scan request is never stored raw — it's hashed before anything touches a database.
Why this matters right now
Certificate maximum lifetimes are already down to 200 days as of March 2026, dropping to 100 days in March 2027. Any hostname still relying on a manually issued, long-lived certificate is on borrowed time — and the fix (moving to an automated ACME client) takes minutes to identify but is easy to keep putting off without a clear signal that it's actually needed.