About httpsstatus.nl

Why We Built This

The httpsstatus.nl was created to promote security and best practices on the web, and provide useful tooling that are all hosted in the Netherlands. Our goal is to make it easy for website owners, developers, and security professionals to quickly assess the HTTPS security posture of any website, while being hosted in the Netherlands.

Similar to services like SSL Labs and Security Headers, we provide security analysis, but with a focus on privacy and transparency. We believe that security tools should be accessible to everyone, and that privacy should be built into every service from the ground up.

This service is hosted in the Netherlands on Thalassa Cloud, a European cloud infrastructure provider.

What We Check

Our service performs a comprehensive security analysis of websites, checking:

• DNS Configuration - Comprehensive DNS analysis including:
  • A Records (IPv4 addresses)
  • AAAA Records (IPv6 addresses)
  • DNSSEC (DNS Security Extensions) - Cryptographic authentication of DNS records
  • CAA Records (Certificate Authority Authorization) - Restricts which CAs can issue certificates
• HTTPS Availability - Whether the website supports secure HTTPS connections
• HTTP Redirects - Whether HTTP traffic is properly redirected to HTTPS
• TLS/SSL Configuration - Certificate and protocol analysis:
  • Certificate validity and expiration dates
  • Certificate chain validation
  • Self-signed certificate detection
  • Certificate Transparency log verification
  • Certificate issuer and subject information
• TLS Protocol Versions - Protocol version analysis:
  • Detection of deprecated protocols (TLS 1.0, TLS 1.1)
  • Verification that legacy TLS versions are disabled
  • Support for modern protocols (TLS 1.2, TLS 1.3)
• Cipher Suites - Basic check of weak or insecure cipher suites
• Security Headers - Check of security headers including:
  • Strict-Transport-Security (HSTS) - Forces HTTPS connections
  • Content-Security-Policy (CSP) - Prevents XSS attacks (with unsafe usage warnings)
  • X-Content-Type-Options - Prevents MIME type sniffing
  • X-Frame-Options - Prevents clickjacking attacks
  • Referrer-Policy - Controls referrer information
  • Permissions-Policy - Controls browser features and APIs
  • Cross-Origin policies (COEP, COOP, CORP) - Cross-origin isolation
• Multi-IP Consistency - Verifies that all IP addresses for a domain return consistent TLS certificates and security headers (important for load balancers, CDNs, and multi-server setups)
• Overall Security Grade - A-F rating based on all security factors with detailed scoring breakdown

Privacy Commitment

We take your privacy seriously. This service:

• No Database Storage - URLs and check results are never stored in a database
• No Tracking - We don't track users or build profiles
• Privacy-Friendly Logging - IP addresses are hashed for logging purposes
• GDPR Compliant - Hosted in the Netherlands, following European data protection regulations