KitJade
Network & CybersecurityAPI-assistedNew

TLS Configuration Checker

Check HTTPS redirects and HSTS headers.

Use the TLS Configuration Checker tool

Uses a KitJade API for the live checkUpdated Report a problem

What this tls configuration checker does

TLS Configuration Checker asks the KitJade Worker to request a URL and report the redirect chain and response headers. It then flags whether the chain ends at https, how many hops it took, and whether Strict-Transport-Security is present with a usable max-age.

This is a transport-behaviour check, not a full TLS audit. A browser cannot inspect certificate chains, cipher suites or protocol versions for an arbitrary host, and the Worker does not either. For certificate and cipher detail, use a dedicated scanner that performs a real TLS handshake.

Why use it

  • Confirm that http:// redirects to https:// rather than serving both.
  • See whether HSTS is enabled and how long browsers will remember it.
  • Count unnecessary redirect hops that slow every first visit.

How to use it

  1. 1Enter the http:// or www URL you want to test.
  2. 2Run the check.
  3. 3Review the final URL, hop count and HSTS status.
  4. 4Fix missing redirects at the origin or CDN, then re-run.

Worked examples

Correct setup

Input

http://example.com

Output

A single 301 to https://example.com with an HSTS header present.

Redirect chain

Input

http://www.example.com

Output

Several hops are listed, and the tool warns when the chain is longer than necessary.

Common mistakes

  • Assuming the tool validates the certificate; it does not.
  • Enabling HSTS without also serving every subdomain over HTTPS.
  • Testing only https:// and concluding that the http:// redirect is fine.

Frequently asked questions

Does it check my SSL certificate?
No. It checks redirects and response headers. Certificate validity needs a server-side handshake tool.
What HSTS max-age should I use?
Start shorter while testing, then raise it once every subdomain works over HTTPS. Long max-age values are hard to undo.
Why does it stop after a few redirects?
Redirect loops and very long chains are capped so the check finishes and reports the problem.
Is the request sent from my browser?
No. The Worker makes the request because cross-origin header reads are blocked in the browser.

Related tools

All tools

HTTP Header Checker

Response headers plus a practical security-header audit.

API-assisted

HTTP Status Checker

Status codes, redirects and final URL.

API-assistedNew

SSL Certificate Checker

Check TLS issuer, expiry and covered domains.

API-assisted

DNS Propagation Checker

Compare answers from two independent public resolvers.

New