No signup, nothing stored. Checking somebody else's site is fine: this only reads what every visitor's browser already downloads.
This checks the page your address serves to a normal visitor, the same way a browser would, and it opens any Google Tag Manager container it finds and reads inside it. Nothing is stored, no signup is asked for, and the answer is the same one you would get by opening the page source yourself with more patience than most people have.
What the visitor actually sees
Not a technical error. A grey Not secure label where competitors have a padlock, and on any page with a form, a warning that appears the moment they click into the field. Most people cannot say what it means and will not ask. They go back to the search results and open the next result, which is the whole cost of it.
It is almost always free to fix
Let's Encrypt issues certificates at no cost and every serious host installs them in a click or has already. Wix, Squarespace, Shopify and Webflow include it. If a site is on HTTP in 2026 it is nearly always an old self-hosted setup nobody has logged into for years, or a certificate that expired and never renewed.
The half-fixed case that is easy to miss
A site can have a valid certificate and still show a broken padlock, because one image, font or script on the page is still being loaded over plain HTTP. Browsers call that mixed content and they downgrade the padlock for it. The certificate is fine; the page is not. That is worth knowing before paying anyone to reissue a certificate that was never the problem.
How to check it by hand
Look at the address bar. A padlock means it is fine. Not secure means it is not. To find mixed content, open the page, press F12, open the Console tab and reload: any resource still on HTTP is listed there by name, which tells you exactly which line needs changing.
Common questions
Does HTTPS affect my Google ranking?
Google has treated it as a ranking signal since 2014, but it is a small one. The real cost is the warning the visitor sees before they ever get to a page, which does far more damage than the ranking difference.
How much does a certificate cost?
Nothing, in most cases. Let's Encrypt is free and automatic on any modern host, and hosted platforms include it. Paid certificates exist and are almost never necessary for a small business site.
My site has the padlock on some pages but not others.
That is mixed content: the certificate is valid but something on those pages is still loading over HTTP. Find it in the browser console, change the URL to https, and the padlock comes back.
Do I need HTTPS if my site has no forms?
Yes. The warning appears regardless of what is on the page, and a visitor deciding between you and a competitor sees it before they read a word.