SUBJECT—
ISSUER—
VALID FROM—
VALID TO—
SAN—
SHA-256—
SERIAL—
KEY BITS—
HTTP & HTTPS
INSPECTOR.
See what a web service shows an external client: status, redirect, headers and the security controls you can observe. For HTTPS, also confirm the connection was accepted and use Certificate Transparency as historical context. Protocol, cipher and the peer certificate need a local check.
Redirects are shown but not followed: the goal is to show the public HTTP surface, not to crawl the site. HTTPS is validated with the Cloudflare Worker fetch(). That confirms the HTTPS connection was accepted, but the runtime does not expose the peer certificate, the cipher or the negotiated TLS version. Certificate metadata comes from Certificate Transparency and is clearly marked as historical and passive.
HTTP // LIVE
Observed response
STATUS—
IP—
DURATION—
SERVER—
CONTENT-TYPE—
REDIRECT—
CONFIG // SIGNALS
Headers at a glance
SHOW OBSERVED HEADERS
DECISION // SUMMARY
—Operational summary
HTTPS FETCH—
TLS PROTOCOL—
CIPHER—
CT DAYS LEFT—
CONNECTED IP—
SNI—
CERT SOURCE—
CHAIN // CERTIFICATES
Presented chain
LOCAL // VERIFY
Equivalent commands
OPENSSL
CURL
RUNTIME LIMITATION //
Cloudflare Workers must use fetch() for HTTP/HTTPS on ports 80/443. So the portal can validate HTTPS, but it cannot read the peer certificate, the cipher or the TLS version of the connection directly. The site's Server header is not visible either: Cloudflare replaces it on Worker requests. For an exact audit, run the OpenSSL and cURL commands above.
SHOW JSON RESPONSE
Frequently asked questions
What does HTTP & HTTPS show?
Status, redirects and security headers (HSTS, CSP, X-Frame-Options and others) as an external client sees them, plus evidence of the TLS connection and the certificate history in Certificate Transparency.
Why are the protocol, cipher and certificate shown as not measured?
The environment that makes the connection does not expose those details. To see them, run openssl s_client or curl -v on your machine; the page gives you the commands.
Is HSTS required?
No, but it is recommended for HTTPS-only sites. It makes the browser refuse unencrypted connections to the domain for the period set in max-age.
Are all listed certificates in use?
Not necessarily. Certificate Transparency is history: it shows the certificates that were issued, including expired and replaced ones.
Can I test plain HTTP, without TLS?
Yes. Choose HTTP as the scheme and the page shows the response and headers without the TLS part, which helps you check the redirect to HTTPS.