SSL certificate checker
Validates your SSL certificate and warns when fewer than 30 days remain.
What TMOD checks
- That the site is served over HTTPS and the certificate is valid for the hostname requested.
- Certificate expiry, with a warning raised when fewer than 30 days remain.
- Whether the certificate chain is complete, a missing intermediate certificate works in some browsers and fails in others, which is the hardest TLS problem to notice.
- Whether HTTP requests redirect to HTTPS, checked separately by the canonicalization engine.
Why it matters
HTTPS has been a ranking signal since 2014 and a browser requirement in practice for years. A site without it is marked Not Secure in the address bar, which is visible to every visitor before they read anything.
For AdSense, HTTPS is effectively mandatory. Ad serving over an insecure connection is blocked or degraded, and mixed content, secure pages loading insecure resources, breaks ads specifically while often leaving the rest of the page looking fine.
The 30-day expiry warning exists because certificate expiry is an outage, not a degradation. An expired certificate makes the whole site unreachable behind a full-page browser interstitial. Automated renewal is normal now and it still fails more often than people expect, usually silently, in a cron job nobody is watching.
How to fix it
01Use automated renewal and verify it works
Let's Encrypt with certbot, or whatever your host provides, is free and automatic. Setting it up is not the same as confirming it renews, check that a renewal has actually happened at least once before trusting it.
02Serve the full chain
If some visitors report certificate errors and you cannot reproduce them, a missing intermediate certificate is the usual cause. Browsers with a cached intermediate succeed while fresh ones fail. Configure the server to serve the full chain file, not just the leaf certificate.
03Redirect HTTP to HTTPS permanently
A 301 from http to https on every URL. Without it both versions are reachable, which is a duplicate-content problem as well as a security one.
04Fix mixed content after switching
Once on HTTPS, any resource still loaded over http is blocked. Update hardcoded http URLs in your content, theme and database, old image URLs inside post content are the usual survivors. Mixed-content detection runs on every crawled page for exactly this reason.
What a certificate proves and what it does not
A standard certificate proves two things: the connection is encrypted, and the server you reached controls the hostname you asked for. That is all, and it is enough for a content site. It says nothing about who runs the site, whether the business is real, or whether the content is trustworthy, which is why a padlock has never been a trust badge and why phishing sites have valid certificates too.
Organisation and extended validation certificates add checks on the legal entity behind the domain, and browsers stopped showing that distinction prominently years ago. For a publisher, they buy nothing a free certificate does not already provide. Where money changes hands and a compliance requirement names them, that is a different decision, and it is a legal one rather than a technical one.
The upgrade worth making instead is HSTS, which tells browsers to refuse plain http for your domain in future. It closes the gap where the very first request goes out unencrypted before your redirect answers, and unlike a certificate upgrade it costs one header. Add it after you are confident every subdomain is on https, because it applies to all of them and it is deliberately hard to undo.
Renewal is the entire job
Certificates are short-lived now, typically 90 days, on the reasoning that anything renewed that often has to be automated. The automation is reliable and the things around it are not, which is why expiry remains a common outage on otherwise well-run sites.
The failures are consistent. The renewal job runs on a server that was replaced. Port 80 gets firewalled off, and the challenge that proves domain control cannot complete. DNS moves to a new provider and the API credentials for the DNS challenge are never updated. A CDN sits in front and serves its own cached certificate while the origin renews happily behind it. In every case the renewal fails quietly and the site keeps working, right up to the day it does not.
So treat the 30-day warning here as the monitoring rather than the nuisance, confirm at least one renewal has actually completed before trusting the setup, and check the full chain is served rather than the leaf alone. And when a certificate does move, re-check that the sitemap lists https URLs and that the handshake is not adding latency from a badly placed origin.
Questions
Is a free certificate as good as a paid one?
For encryption, identical. A Let's Encrypt certificate provides exactly the same TLS security as an expensive one, and browsers treat them the same. Paid certificates offer organisational validation and warranties that matter for banking and commerce; for a content site they buy nothing a free certificate does not already provide.
My certificate is valid but the checker warns about expiry.
That is the 30-day warning and it is informational. The certificate works today. It exists so that a renewal failure surfaces while you still have a month to fix it, rather than as a site-wide outage on the day it lapses.
I switched to HTTPS and my traffic dropped.
That usually means the migration was incomplete rather than that HTTPS hurt you. Check that every HTTP URL 301s to its HTTPS equivalent, that canonical tags point at HTTPS, that the sitemap lists HTTPS URLs, and that the HTTPS property is registered in Search Console, it is treated as a separate site there.