SSL & Security

HSTS Checker

HSTS Preload

Check a domain's HSTS policy

We'll request the domain over HTTPS and inspect the Strict-Transport-Security response header, plus its status on the browser preload list.

Try:
github.com
mozilla.org
cloudflare.com

Tool features

Comprehensive HSTS and security header analysis with recommendations
4 checks

HSTS Detection

Check if HTTP Strict Transport Security is properly configured

Security Analysis

Comprehensive security header analysis and validation

Configuration Validation

Validate HSTS parameters and detect configuration issues

Security Score

Get an overall security score with improvement recommendations

What is HSTS & how it works

How a site enforces HTTPS-only connections

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to only ever reach your site over HTTPS. Once a browser sees it, every future request is upgraded to HTTPS automatically — even if a user types http:// or clicks an insecure link — closing the window where a connection could be intercepted.

The policy is published as a single Strict-Transport-Security header with a max-age (how long to remember it), optional includeSubDomains, and an optional preload directive. This tool reads the live header, scores the configuration, and checks eligibility for the browser preload list.

max-age
Seconds a browser enforces HTTPS-only for the host; longer is stronger.
includeSubDomains
Extends the policy to every subdomain, not just the exact host.
preload
Opts the domain into the browser-shipped HSTS preload list.

How to use this tool

Check a domain's HSTS policy in four steps
1
Enter a domain or URL
Type a hostname or full URL, e.g. example.com or https://example.com.
2
Run the check
Click Check HSTS Security to request the site over HTTPS and read its Strict-Transport-Security header.
3
Review the score
See the security score, the parsed max-age / includeSubDomains / preload directives, and any warnings.
4
Apply the guidance
Follow the server-specific snippets and rollout tips to add or strengthen the policy safely.

Related tools

Keep debugging with tools from the same suite
4 tools
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
OCSP Checker
Check SSL certificate revocation status using the Online Certificate Status Protocol (OCSP)
X-Frame Options Checker
Check X-Frame-Options header to prevent clickjacking attacks and iframe embedding
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment

Frequently asked questions

Common questions about HSTS
5 Q&A

HSTS (HTTP Strict Transport Security) is a response header that forces browsers to connect to your site only over HTTPS, preventing protocol-downgrade and cookie-hijacking attacks.

For a mature site, use max-age=31536000 (one year). Start lower while testing so a misconfiguration expires quickly, then raise it once you are confident every subdomain serves HTTPS.

It applies the HTTPS-only policy to every subdomain of the host, not just the exact domain. Only enable it once you are certain all subdomains support HTTPS, or they will become unreachable.

Preload ships your domain in browsers’ built-in HSTS list, so HTTPS is enforced even on the very first visit. It requires max-age of at least one year, includeSubDomains, the preload directive, and submission to hstspreload.org.

Removal is slow — it can take months to propagate through browser releases. Only submit to the preload list once your whole domain, including every subdomain, reliably serves HTTPS.