"Secure" here means the connection between a visitor's browser and your site: the padlock, or a warning. It says nothing about whether the business behind the page can be trusted, and it isn't a security audit.
Updated
We make one real secure connection to your site and check its certificate the way a browser does: is it within its dates, issued for this address, and from an issuer browsers trust? Then our browser loads the page and notes whether anything on a secure page loads over plain http, which browsers block or flag. We ask Google's Web Risk service whether the address is on Google's lists of unsafe sites, the lists behind Safe Browsing warnings. If a check can't run, for example because the connection timed out, it says "not measured". We don't probe your server, test logins or run anything like a vulnerability scan. Each check is a full FlowScan scan, so you also get a free report on the rest of the page.
| Check | How we measure it |
|---|---|
| Certificate: valid, expired, wrong address or untrusted issuer | One real secure connection, checked the way a browser checks it |
| Page address uses https | The address the page ended on |
| Files loaded over plain http on a secure page | What the page loaded in our browser |
| Google's lists of unsafe sites | Google Web Risk lookup |
Chrome shows "Not secure" in the address bar when a page loads over plain http instead of https. A certificate that is expired, self-signed or issued for a different address gets a full-page warning instead. Files loaded over plain http on a secure page get blocked or flagged.
A valid certificate covers the connection to your page, not files the page loads over plain http. Browsers block or flag those, so parts of the page can vanish or stop working. The result says whether we saw any.
No. It means the connection is encrypted, not that the business is trustworthy.
Most hosts and site builders include a free one, usually as a setting in the hosting or domain panel. Let's Encrypt issues free certificates that most hosts can install and renew for you.
Google's lists of sites it believes carry malware, phishing or unwanted software. Browsers that use Google Safe Browsing, including Chrome, warn visitors before opening a listed address. We ask Google whether yours is on them.
Google has used https as a ranking signal since 2014. And a visitor who taps an ad and meets a browser warning has every reason to go back.
A "secure" badge would suggest a security status we don't assess, so we don't offer one.
No, we never submit your form. We don't log in or create accounts either, and the ad tracking on your page is stopped inside our browser, so our check isn't counted as a lead in your ad accounts.