Go-Live Clearance

Transport · TLS

SSL / HTTPS Checker

Shipping on HTTP — or a cert that expires mid-launch week — is an instant trust failure. Paste the URL you will put on Product Hunt / ads. We check redirect enforcement and certificate signals, then stamp CLEARED / HOLD / DENIED.

Transport failures we catch

  • No HTTPS redirect

    Visitors and crawlers can stay on http://. Mixed content and cookie flags break next.

  • Certificate expiring soon

    Auto-renewal silent failures are common on DIY DNS. A warning now beats a DENIED launch day.

  • Wrong host / name mismatch

    www vs apex, or a leftover preview hostname, shows browser interstitial on first click.

  • HTTP-only deep links in OG / emails

    Share cards and campaigns send people to insecure URLs even when the homepage redirects.

Platform redirects

Prefer the platform toggle; fall back to config when you must.

Vercel — force HTTPS (Domains)

# Vercel Dashboard → Project → Settings → Domains
# Attach apex + www, wait until SSL = Valid
# Redirect www ↔ apex so one canonical HTTPS host wins

Next.js — middleware HTTPS nudge (edge cases)

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(req: NextRequest) {
  if (
    process.env.NODE_ENV === 'production' &&
    req.headers.get('x-forwarded-proto') === 'http'
  ) {
    const url = req.nextUrl.clone()
    url.protocol = 'https:'
    return NextResponse.redirect(url, 308)
  }
  return NextResponse.next()
}

Still check by hand

  • □Test both apex and www after DNS changes
  • □Open the site in a phone browser on cellular (not only Wi‑Fi)
  • □Confirm Stripe / OAuth callback URLs are https://

Related