Is the site secure, and when does the certificate run out?

Why it matters

An expired certificate puts a full-page “Not secure” warning in front of every visitor, and most people leave. Certificates from Let’s Encrypt and similar renew themselves every few months; when that renewal quietly breaks, nobody notices until the site goes red.

Security headers are a few lines of server configuration that block whole classes of attacks, such as clickjacking and content injection. Browsers and security scanners check for them, and they take minutes to add.

If the plain http:// address doesn’t redirect to https://, visitors and search engines can land on the insecure version, and search engines may index both.