SSL Labs tests your certificate and nothing else. Scan.now tests your certificate plus 178 other things, in about fifteen seconds, and hands you the fix for each one. A perfect certificate on a site with an open .git folder is still a site with an open .git folder.
Both tools look at the lock icon in your browser and tell you whether it means anything. Only one of them keeps going afterwards.
If you only run one test
- You want to know if your site is safe. Use Scan.now. TLS is one of the 179 things we check, and you get all of them in one run.
- You want to tune TLS specifically. SSL Labs goes deeper on that one subject than anyone, including us.
A perfect certificate on a broken site
Here is the problem with checking only the certificate. We scan thousands of sites, and the ones that fail badly almost never fail on TLS. They fail because a header is missing, a cookie is not marked private, an old JavaScript library has a published hole in it, or a folder that should be private is readable by anyone who types its name.
A TLS test cannot see any of that. It will give a site an A while the front door stands open.
Side by side
| Scan.now | SSL Labs | |
|---|---|---|
| Checks TLS and certificates | Yes | Yes, in more depth |
| Checks security headers | Yes, 13 of them | No |
| Checks cookies | Yes | No |
| Finds exposed files | Yes | No |
| Finds old JavaScript with known holes | Yes | No |
| Checks email spoofing | Yes | No |
| Checks WordPress plugins | Yes | No |
| Total checks | 179, each with its own page | One subject |
| Gives you the fix to paste | Yes | No |
| Scans more than one page | Yes, 25 free | No |
| Time to a result | About 15 seconds | A minute or two, sometimes a queue |
| Is your result private? | Yes. Unlisted link, deleted after 30 days | Public by default. You can opt out |
What the extra breadth buys you
You find everything in one pass. One address, fifteen seconds, and you know about your certificate, your headers, your cookies, your exposed files, your JavaScript and your email records. Running eight single-purpose tools takes an afternoon and you will forget one.
You get the fix, not just the finding. Every result links to a page with the test, the risk behind it, and configuration for Apache, nginx and the common hosts. Copy, paste, scan again. SSL Labs shows you a problem and leaves you to research it.
Your results stay yours. SSL Labs publishes results by default, so anyone can look up what your server is running. Ours sit behind an unlisted link and are deleted after 30 days.
It covers the whole site. A single-page test finds problems in one template. Free scans crawl up to 25 pages and catch the ones that were missed.
Where SSL Labs goes deeper
On TLS alone, it goes further than we do. It simulates dozens of real browsers and devices to show which can connect, and it reads the exact order your server offers its encryption settings in. If you are tuning a TLS configuration line by line, that detail is useful.
For everyone else, the question is not "is my TLS perfect" but "is my site safe", and that is a much bigger question.
A sensible order
- Run a full scan. Fifteen seconds, no account.
- Work down the list. The most serious findings are at the top, and each one tells you what to paste.
- Re-check as you go with our SSL/TLS checker.
- If TLS turns out to be your weak spot, run SSL Labs for the extra detail.
Common questions about TLS testing
Is Scan.now's TLS check good enough?
For almost everyone, yes. We catch what actually goes wrong: expired certificates, wrong hostnames, broken trust chains, deprecated protocol versions and weak encryption. Those are the failures that take a site down or throw a browser warning. SSL Labs goes further for people tuning a configuration.
Why are SSL Labs results public?
The project doubles as a public dataset about how the web is configured. There is a box to hide your result, and you have to remember to tick it. We made the opposite choice: private by default, deleted after 30 days.
Do I have to pay?
No. Scan.now is free for scans of up to 25 pages, which covers almost everyone. SSL Labs is free too.