Site health check

Runs the TLS certificate check, the security headers check and the RDAP lookup in parallel and returns one section per check. A section that fails is marked and the status becomes unknown. There is no score.

Updated 2026-10-26

What this tool checks

A website can fail in three places that have little to do with its content: the certificate, the way HTTP and HTTPS are wired together, and the domain registration underneath. The site health check looks at all three at once:

TLS certificate check: whether the certificate on port 443 is trusted, matches the name and is not about to expire, with its chain, key and signature.
Security headers check: the redirect chains from http:// and https://, HSTS and preload readiness, Content Security Policy, frame protection, X-Content-Type-Options, Referrer-Policy and cookie flags.
RDAP domain lookup: the registrar, the expiry date and EPP statuses such as hold or pending delete, from the registry itself.

Every section behaves exactly like the tool it links to, so a finding in the report means the same as on the single check.

How to read the result

The report has one section per check and one list of findings with codes, severities and evidence. The overall status is the most serious severity found: ok, then info, warning and error. There is no score.

If a section cannot be completed on Lookproof's side, for example because the DNS resolver fails, that section is empty, the technical finding is added and the overall status becomes unknown. The other sections are still shown. Only when all three fail is no report produced.

For the mail and DNS side of the same domain, run the domain health check.

Limitations

Only ports 443 and 80 and the start page are looked at; other hosts, paths and APIs can be configured differently.
Page content, JavaScript and cookie values are never read.
Registration data comes from the registry's RDAP service, which some country-code domains do not offer yet.

Use it from code

API reference for Site health check

curl -i "https://api.lookproof.dev/v1/site/health?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	15 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.025 per check

Findings this tool can report

Cookies (1)

Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.

Content Security Policy (2)

Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Domain registration (6)

Error DOMAIN_EXPIRED The domain registration has expired.
Warning DOMAIN_EXPIRING_SOON The domain registration expires in less than 30 days.
Info DOMAIN_NOT_REGISTERED The registry has no record of the domain.
Error DOMAIN_ON_HOLD The domain is on hold and is not published in DNS.
Error DOMAIN_PENDING_DELETE The domain is about to be deleted.
Info DOMAIN_TRANSFER_UNLOCKED The domain has no transfer lock.

Frame protection (1)

Info FRAME_PROTECTION_MISSING The HTTPS site does not restrict who may frame it.

HSTS (3)

Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

HTTP (2)

Warning HTTP_NO_HTTPS_REDIRECT Plain HTTP is not redirected to HTTPS.
Info HTTP_UNAVAILABLE The site does not answer over plain HTTP.

HTTPS (1)

Error HTTPS_UNAVAILABLE The site could not be loaded over HTTPS.

RDAP (1)

Info RDAP_UNAVAILABLE The registry's RDAP service could not be asked about the domain.

Redirects (2)

Warning REDIRECT_LIMIT The site redirects more than five times in a row.
Info REDIRECT_OFFSITE The site redirects to another domain.

Referrer-Policy (1)

Info REFERRER_POLICY_MISSING The HTTPS site sends no Referrer-Policy header.

TLS certificate (8)

Error TLS_CERT_EXPIRED The TLS certificate has expired.
Info TLS_CERT_EXPIRING The TLS certificate expires within 30 days.
Warning TLS_CERT_EXPIRING_SOON The TLS certificate expires in less than 14 days.
Error TLS_HOSTNAME_MISMATCH The TLS certificate is not valid for the domain name.
Error TLS_UNAVAILABLE No TLS connection to the domain on port 443 could be made.
Error TLS_UNTRUSTED The TLS certificate does not chain to a trusted certificate authority.
Warning TLS_WEAK_KEY The TLS certificate uses a weak public key.
Warning TLS_WEAK_SIGNATURE A certificate in the chain is signed with SHA-1 or MD5.

X-Content-Type-Options (1)

Info XCTO_MISSING The HTTPS site sends no X-Content-Type-Options: nosniff header.

Frequently asked questions

What does the site health check cover?

Three checks run together on the domain: the TLS certificate check, the security headers check with both redirect chains, and the RDAP domain lookup for registration and expiry. Each has its own section in the report and also exists as a separate tool.

Is this the same as an SSL check?

It includes one. The TLS section checks the certificate the way a strict client does: trust chain, name, expiry date, key and signature. The report then adds what decides whether visitors actually end up on HTTPS, and whether the domain itself is about to lapse.

Why is there no score or grade?

A grade mixes very different things. An expired certificate stops every visitor; a missing Referrer-Policy header changes little for a brochure site. The report lists every finding with its code and severity, and the overall status is the most serious one. What matters for your site is your call.

How is this different from the domain health check?

The domain health check covers mail and DNS: SPF, DMARC, DKIM, MTA-STS, DNSSEC, CAA and more. The site health check covers the web side. Together they give the whole picture of a domain.