Check the address bar first
Open the exact website address and check the browser address bar. If it begins with https:// and the browser reports a secure connection without a certificate warning, that browser has established HTTPS for that hostname. If the address begins with http://, the page is using an unencrypted HTTP connection.
A panel can show that a certificate request is configured, but a browser check shows what is actually served to a visitor at the hostname tested. If they disagree, diagnose the exact hostname and endpoint before repeating certificate requests. This guide covers that visitor-side check; the separate DirectAdmin guide covers its panel workflow.
Browser icons and menus vary by browser, device and version. In Chrome, select the security-status symbol beside the address to read the connection information. Do not rely on an old padlock picture alone: read the hostname and the browser’s current status.
HTTPS protects data in transit between the browser and the site endpoint. It does not prove that the business is genuine, that the page is free of harmful content, or that every part of the site uses HTTPS. Check the domain carefully before entering information.
Test each hostname people actually use
Check the exact names used for the website, sign-in page, forms and other public pages. The main domain and www name can resolve to different services or present different certificates. A working homepage does not prove every subdomain is configured.
- Open
https://example.com/and note whether it loads without a certificate warning. - Repeat for
https://www.example.com/if visitors use that name. - Try the corresponding
http://addresses and note the final URL shown by the browser. - Test important public paths such as a contact form or sign-in page, without submitting personal data.
Replace example.com with your own hostname. A connection error on one name can be a DNS, routing or certificate issue; it does not establish that the whole domain is down.
Check whether HTTP redirects to HTTPS
For a website you manage, an HTTP request should normally lead visitors to the intended HTTPS URL if the site is configured to use HTTPS everywhere. Confirm that the final host and path are correct, and that the browser does not stop at a warning or loop between addresses.
A browser may remember a previous HTTPS upgrade or use a site’s security policy, so its behaviour alone may not reveal the server’s first response. To inspect the first public response from a computer with curl, run these read-only checks with your own hostname:
curl -sS -o /dev/null -D - --max-redirs 0 http://example.com/
curl -sS -o /dev/null -D - --max-redirs 0 https://example.com/The first command should show the initial HTTP status and any Location header without following the redirect. Check that the destination uses HTTPS and the expected hostname. If curl is unavailable or the output is unclear, use your hosting provider’s supported diagnostic tools or ask the site operator to confirm the response.
If the browser shows a certificate warning
A certificate warning means the browser could not establish a connection it accepts for that address. Record the exact hostname and warning text; do not bypass the warning to continue, enter a password or submit a form.
For the site owner, compare the affected hostname with the names covered by the certificate and the certificate’s validity dates. Check that the device date and time are correct. If the warning occurs only on a managed work network, VPN or security-filtered connection, the network operator may need to investigate it. The same warning can have a site-side, network-side or device-side cause.
Do not install an unfamiliar certificate or switch off browser protection as a workaround. Contact the website operator or the service provider that controls the affected endpoint.
What an HTTPS check does not tell you
A page can load through HTTPS while requesting some scripts, styles, images or other resources over HTTP. Browsers may block or upgrade mixed-content requests, so inspect the affected page as well as its address bar. If you manage the site, check the browser’s developer console for mixed-content warnings and test the main templates and forms.
An HTTPS connection is not a trust seal for the organisation or the content. A legitimate and a deceptive site can both use HTTPS. Confirm the domain spelling and use a trusted route before sharing sensitive information.
For the separate task of fixing insecure assets after an HTTPS migration, see how to fix mixed content after moving a site to HTTPS. If the browser keeps moving between HTTP and HTTPS, use the redirect-loop diagnosis guide.
If a Novasean-hosted website fails the check
If the affected site is hosted with Novasean, contact us through the support route for your service. Include the public hostname, whether you tested HTTP or HTTPS, the final URL or exact browser error, and when you observed it. Do not send passwords, recovery codes, private keys or customer data.
For a DirectAdmin account, the guide to requesting and checking a TLS certificate covers the panel workflow. The available controls depend on the service and account permissions. Do not change DNS, force redirects or request repeated certificates until you know which hostname and configuration layer is failing.
Frequently asked questions
How can I tell if a site uses HTTPS? Check that the address begins with https:// and that your browser accepts the connection without a certificate warning.
Does HTTPS mean a website is safe? No. It protects the connection to the addressed site, but it does not prove the site or its operator is trustworthy.
Why does the homepage use HTTPS but another page warn? A subdomain can use a different endpoint or certificate. Test the exact hostname and page that fails.
Is seeing HTTPS enough to confirm every page is secure? No. A secure page can still request insecure resources, and one successful hostname does not prove every hostname or route is configured.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.