Does your site speak
the modern internet?
Enter a domain — we test four things at once: HTTPS enforcement, HTTP/2 (and HTTP/3), the HSTS header, and whether your site answers on IPv6. One scoreboard, zero jargon.
Four letters of modern.
None of these are exotic. They’re the current defaults of the web — and each one your server skips has a real cost.
HTTPS
The baseline. Not just “does :443 answer” — is it a valid certificate, and does plain http:// get redirected instead of served?
is it secure?HTTP/2
One connection, everything multiplexed — pages with many assets load visibly faster. Every browser has spoken it since 2015. We also check for HTTP/3.
is it fast?HSTS
One header that tells browsers “never try plain HTTP here again.” Closes the first-visit hole that an https redirect alone leaves open.
is it enforced?IPv6
An AAAA record plus a server that actually answers on it. Without one, v6-native users (most mobile networks) reach you through a translator, or not at all.
is it reachable?What the answers actually mean
Six readouts you’ll meet in this tool, and in your own terminal, decoded before you have to search for them.
The server declined h2 and fell back to 1997’s protocol: one request at a time per connection. Browsers queue your assets; visitors call it “slow”.
Negotiated inside the TLS handshake — before any HTTP happens, both sides agree to speak HTTP/2. This is where we read it, so no header can fake it.
The server advertises HTTP/3 — QUIC over UDP, handshake and transport merged. Browsers switch to it on the next visit automatically.
The HSTS self-destruct: this value orders browsers to forget the policy. Sometimes deliberate, more often a config accident that silently disarms everything.
Your site has no IPv6 address at all — it simply doesn’t exist on the v6 internet. Worse is an AAAA that doesn’t answer: v6 users then wait for a timeout first.
The token that requests entry to the browser-baked HSTS list — https enforced before the first packet. The strongest setting here, and effectively a one-way door: leaving takes months.
Four upgrades, one afternoon
None of these are projects. They’re config lines that most servers simply haven’t been told about — usually because the config predates the protocol:
- HTTP/2 — on nginx 1.25.1+ it is one line: http2 on;
- HSTS — one header line. Start with max-age=300, ramp to a year once nothing breaks.
- IPv6 — your VPS almost certainly has a v6 address already; add listen [::]:443 ssl; and publish the AAAA.
- HTTPS — if you’re missing this one, Let’s Encrypt has been free for a decade. Start here, today.
Who’s already there
where each one standsThe curl crib sheet, decoded.
Everything this page does has a one-liner equivalent. We run them all at once and translate the output.
Common questions
Type the domain above. We read the answer from the ALPN field of the TLS handshake itself, which is where HTTP/2 is actually negotiated, so no header can fake it. In your own browser: DevTools → Network → right-click the columns → enable “Protocol” (h2 or h3 means yes). In a terminal: curl -sI -o /dev/null -w '%{http_version}' https://yoursite.com.
Three layers, and most checkers stop at the first. Does :443 answer with a valid certificate? Does plain http:// redirect to https, rather than serving the site unencrypted in parallel? And is HSTS set, so browsers stop trying http at all? “The padlock shows up” only proves layer one. This tool scores all three separately, which is why HTTPS and HSTS are different tracks.
Two steps, and both matter: does an AAAA record exist, and does the server behind it actually answer? We test both from a v6-enabled probe and compare the content against the v4 answer. Note that curl -6 from your own machine only works if your network has IPv6, and many office networks still don’t. That is why a remote checker is the reliable way to test this.
For real pages, yes. HTTP/1.1 handles one request at a time per connection, so browsers juggle six connections and queue the rest. A page with dozens of assets spends real time waiting in that queue. HTTP/2 multiplexes everything over one connection and compresses headers. Two caveats: your server’s time-to-first-byte doesn’t change, and a page with three assets won’t feel different. HTTP/3 goes further by fixing packet-loss stalls, which shows up on flaky mobile networks.
HSTS is one response header: “only ever contact this site over https, for the next N seconds.” It closes the gap your redirect leaves open: that very first http:// request, which can be intercepted before the redirect happens. Rollout advice: start with max-age=300, verify nothing breaks (subdomains especially), then raise to a year. Preload bakes your domain into the browsers themselves. Maximum protection, but effectively a one-way door: getting off the list takes months. Ramp first, preload when certain.
Because a growing share of your visitors are on v6-native networks: most mobile carriers, and whole markets where v6 is the default. They still reach your v4-only site, but through carrier-grade translation. That is an extra middlebox adding latency and occasionally breaking things, entirely outside your control. Dual-stack removes it. It also future-proofs you: v4 addresses are exhausted and only get more expensive to route around.
Constantly — that’s the catch. A new load balancer answers HTTP/1.1 because nobody set h2 on it; a config refactor drops the HSTS line; a migration forgets the AAAA record. Browsers won’t warn anyone and users won’t email you — the site still “works”. Re-run this check after every infrastructure change. Uptimia’s uptime monitoring covers the rest of the time.
Free tools are just the start.
Uptimia keeps your sites healthy.
Uptime, SSL, domain expiry, page speed, transactions — monitored from 171+ locations worldwide. Free for 30 days.