Free HTTPS, SSL Chain & SEO Protocol Auditor

Website HTTPS Checker

Audit your domain's 4-variant HTTPS redirect convergence, full SSL certificate chain (for mobile & AI crawlers), TLS handshake speed, mixed content, and hidden SEO http:// leaks.

tonyherman.com • https://tonyherman.com/ ↗ • Checked 2026-10-16 10:59:33
Rescan Live Robots.txt Checker → DNS TTL Checker →
100 / 100
Grade A+
HTTPS & SSL Rating
Fully Secure & SEO-Aligned
12-Point Security Audit
SSL Certificate Status
Valid (79d left)
Issuer: Google Trust Services
4-Variant Redirects
Unified 301
All 4 URL variants converge to 1 URL
TLS Handshake & Transport
1 ms
TLSv1.3 • HTTP/2

Fully Secure & SEO-Aligned

Excellent! tonyherman.com serves a complete SSL chain, forces 301 HTTPS redirects across all variants, and has zero mixed content.

4-Variant Canonical Redirect Matrix (HTTP vs HTTPS & www vs non-www)

✓ Single Canonical Destination
Tested URL Variant First Hop Status Redirect Hops Final Destination URL Final Status Verdict
http://tonyherman.com/
HTTP (non-www)
 HTTP 301 (Permanent) 1 hop (252ms) https://tonyherman.com/ 200 OK ✓ Optimal
http://www.tonyherman.com/
HTTP (www)
 HTTP 301 (Permanent) 2 hops (59ms) https://tonyherman.com/ 200 OK ✓ Optimal
https://tonyherman.com/
HTTPS (non-www)
 HTTP 200 (Canonical) 0 hops (30ms) https://tonyherman.com/ 200 OK ✓ Optimal
https://www.tonyherman.com/
HTTPS (www)
 HTTP 301 (Permanent) 1 hop (60ms) https://tonyherman.com/ 200 OK ✓ Optimal

SSL/TLS Certificate & Full Chain Visualizer (Mobile & AI Bot Check)

✓ Complete Chain (3 Certs)
Common Name (CN)
tls.automattic.com
Certificate Authority (Issuer)
Google Trust Services (WR1)
Validity Period
Oct 6, 2026 → Jan 4, 2027
Protocol & Cipher Suite
TLSv1.3 • TLS_AES_128_GCM_SHA256
Subject Alternative Names (SANs) • Root Covered: YES • WWW Covered: YES
tls.automattic.com brackwater.org cheekywheekies.org creatingclaritynow.com echocornmaze.com exodushealthcare.com ine.atn.mybluehost.me maineyarncruise.com mikri-arktos.gr okea.indagodigital.dev ovm.huh.mybluehost.me pxg.pth.mybluehost.me rku.xar.mybluehost.me soraural.com suzie.blog tonyherman.com traffo.com.br www.brackwater.org +14 more
Presented Certificate Trust Chain (Leaf → Intermediate CA → Root CA):
#1 • Leaf (Server) Certificate
tls.automattic.com
Issued By: WR1
Expires: Jan 4, 2027
Signature: RSA-SHA256
#2 • Intermediate CA
WR1
Issued By: GTS Root R1
Expires: Feb 20, 2029
Signature: RSA-SHA256
#3 • Intermediate CA
GTS Root R1
Issued By: GlobalSign Root CA
Expires: Jan 28, 2028
Signature: RSA-SHA256

TLS Handshake Speed Waterfall & Hardening Headers

Total Connection: 34 ms
DNS 1ms
TCP 3ms
TLS 1ms
TTFB 30ms
DNS Lookup: 1 ms TCP Connect: 3 ms SSL/TLS Handshake: 1 ms Server TTFB: 30 ms
HSTS Policy (Strict-Transport-Security)
Enabled (max-age=31536000)
HSTS Preload List Eligibility
Missing includeSubDomains / preload
HTTP/2 & HTTP/3 (QUIC) Multiplexing
✓ HTTP/2 Active
DNS CAA Record (CA Lock)
None (Any CA may issue)

Mixed Content, SEO Protocol Leaks & Internal http:// Link Audit

✓ 100% Clean HTTPS Markup
Active Mixed Content (Scripts / CSS)
0 Insecure Resource(s)
Passive Mixed Content (Images / Media)
0 Insecure Media Item(s)
SEO Protocol Leaks (Canonical / OG / Sitemap)
0 Tag Leak(s)
Internal HTTP Link "Redirect Tax"
0 Internal http:// Link(s)

12-Point HTTPS & SSL Rating Breakdown

Score: 100 / 100 (Grade A+)
SSL/TLS Certificate Validity & Trust
Valid certificate issued by Google Trust Services (WR1).
Passed
Certificate Expiration Countdown
Healthy validity window: 79 days remaining (valid until Jan 4, 2027).
Passed
Root & WWW Hostname SAN Coverage
Both tonyherman.com and www.tonyherman.com are covered by the certificate SAN list.
Passed
Intermediate Certificate Chain (Bot & Mobile Compatibility)
Complete certificate chain served (3 certificates in chain).
Passed
Modern TLS Protocol & Cipher Suite
Negotiated TLSv1.3 with TLS_AES_128_GCM_SHA256 (128-bit).
Passed
HTTP to HTTPS Automatic Redirect
Both http://tonyherman.com and http://www.tonyherman.com permanently redirect (301/308) to HTTPS.
Passed
4-Variant Canonical URL Convergence
All 4 URL variants converge cleanly onto https://tonyherman.com/.
Passed
Mixed Content Asset Scan (Scripts, CSS, Images)
Zero insecure http:// scripts, stylesheets, iframes, or images detected on the page.
Passed
SEO Protocol Leaks (Canonical, OpenGraph, Schema & Sitemap)
Canonical tags, OpenGraph URLs, JSON-LD Schema, and Sitemap directives all use https://.
Passed
Internal HTTP Link "Redirect Tax" Check
All internal navigation links link directly to https:// without redirect hops.
Passed
HTTP Strict Transport Security (HSTS)
Active HSTS policy (max-age=31536000).
Passed
HTTP/2, HTTP/3 & DNS CAA Authority Policy
HTTP/2 enabled • TLS handshake: 1ms • No DNS CAA record (optional).
Passed

One-Click HTTPS & HSTS Server Config Generator (tonyherman.com)

✓ No Changes Required (Reference Only)
✓ Your server is already properly configured! The tonyherman.com domain passed all HTTPS redirect, SSL chain, HSTS, and mixed-content checks—no server changes are needed. The snippet below is shown purely as a reference template. 
# Apache .htaccess — Force Single-Hop HTTPS & HSTS for tonyherman.com
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://tonyherman.com%{REQUEST_URI} [L,R=301]

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Content-Security-Policy "upgrade-insecure-requests"
</IfModule>
Disclaimer: This code is a suggested reference based on external HTTP/TLS responses and should be reviewed before being placed into production. Because hosting environments (Cloudflare, managed WordPress hosts, load balancers, and custom Apache/Nginx stacks) handle routing differently, always back up your existing configuration files and test changes before deploying live.

Recent Website HTTPS Audits

tonyherman.com
79d left • HSTS: Yes
100/100 (A+)

Why Complete HTTPS Configuration Matters for SEO & AI Bots

1. Single-Hop 4-Variant Convergence

Your domain can be accessed four ways: http://, http://www., https://, and https://www.. All three non-canonical versions should 301 redirect in a single hop to your primary https:// URL so link equity is never split.

2. Intermediate Certificates & AI Crawlers

Desktop browsers silently download missing intermediate SSL certificates, hiding server misconfigurations. Headless crawlers like GPTBot, ClaudeBot, PerplexityBot, and mobile Safari strictly require your server to send the full certificate chain (fullchain.pem).

3. Eliminating SEO Protocol Leaks

Even when a page loads with a padlock, leftover http:// URLs inside <link rel="canonical">, JSON-LD Schema, or your robots.txt Sitemap directive send conflicting signals to Googlebot and waste crawl budget on redirect hops.