Every scan reads three things about the site it scanned: when its domain registration runs out, when the security certificate it presents expires and whether browsers would trust it, and how it serves HTTPS. Anything close to expiry, or an HTTPS problem, is flagged in the report with the next step to take.
What is read, and when it is flagged
| What | Read from | Flagged when | Points lost |
|---|---|---|---|
| Your domain | The domain registry | It expires within 60 days | 5, or 15 once expired |
| Your certificate | The certificate your site presents on the secure port | It expires within 21 days, or is not trusted by browsers | 5, or 10 once expired |
| HTTPS | Requests to the https:// and http:// versions | The secure version does not load, or http:// does not send visitors to https:// | 10, or 3 for no redirect |
| HSTS | The same https:// request | Shown, never flagged | None |
The points are the ones in your LinkSignal score. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.
What the report says
- The Your site card gives Domain expires in, Certificate expires in and an HTTPS word: Strong, Good (only HSTS is missing), No redirect or Problem.
- The Your site panel on the Inventory tab gives each date, with Not trusted by browsers where that applies.
- A domain or certificate with no date to read is left out rather than guessed. Some domain extensions publish no expiry date, and a certificate can only be read if the site answers on the standard secure port.
What it does not do
- It changes nothing. It connects the way a visitor would and only reads.
- It reads the host in the sitemap address you scanned, once per scan, however many pages were read. Other subdomains are not read.
- It does not read the certificates of the sites you link to. A destination with a failing certificate shows as unreachable with the reason. Their domain expiry is a separate check.
- A check that did not record your site is marked as not recorded and left out of that scan’s score.
Where to read more
Renewing a domain, installing a certificate and setting a header happen at your registrar, host or server, so they go beyond what Link Signals does. It tells you what is close to running out. These help with the rest.
- Check your own domain and certificate: the report’s panels in full, and what to do when each is flagged.
- HSTS and security certificate: plain-language definitions.
- MDN: Strict-Transport-Security: how the header works, and how to add it carefully.
- MDN: Transport Layer Security: what certificates and HTTPS do, for anyone who wants the background.
- Let’s Encrypt: getting started: free certificates that renew automatically, where your host supports them.
Questions
Does Link Signals change my certificate or settings?
No. It reads what any visitor can see: the registry’s expiry date, the certificate your site presents, and the answers to an https:// and an http:// request.
Why is my site Good and not Strong?
Good means the secure version loads and http:// sends visitors to it, and only the HSTS header is missing. It costs no points, and the report suggests adding it once everything else works.
How often is my own site read?
Once per scan. A rescan reads it again, so a renewed domain or certificate clears the flag on the next scan and the points come back.
Run a scan and the Your site card shows your domain, certificate and HTTPS.
