Free HSTS Checker

Validate your HTTP Strict Transport Security (HSTS) header in seconds. Check the max-age, includeSubDomains and preload directives, confirm your HSTS preload list status, and see exactly what to fix before submitting to the preload list.

https://

No credit card required • Instant results

HSTS Header Validation

Confirm the Strict-Transport-Security header is present and parse every directive for correctness.

Directive Analysis

Check max-age duration, the includeSubDomains directive, and the preload flag against current best practice.

Preload List Status

See whether your domain is on the HSTS preload list and whether it meets the requirements to be submitted.

What the HSTS Checker Tests

HSTS Header Configuration

  • Presence of the Strict-Transport-Security header
  • max-age value and recommended duration
  • includeSubDomains directive
  • preload directive for preload list eligibility

Directive Best Practice

  • max-age of at least 1 year (2 years recommended)
  • Subdomain coverage via includeSubDomains
  • Correct preload opt-in syntax
  • Detection of weak or expiring policies

HSTS Preload List

  • Current preload list status
  • Eligibility for preload submission
  • Preload requirements validation
  • Chrome, Firefox and Safari preload coverage

Recommendations

  • Optimal max-age configuration
  • Subdomain coverage guidance
  • Step-by-step preload submission advice
  • Fixes for common HSTS mistakes

Understanding HSTS

HTTP Strict Transport Security (HSTS) is a web security policy that protects sites against protocol downgrade attacks and cookie hijacking. When a site sends the HSTS header, browsers remember to upgrade every future request to HTTPS automatically, even if a user types http:// or clicks an insecure link.

Key benefits:

  • Prevents man-in-the-middle attacks: forces all communication over HTTPS
  • Blocks protocol downgrade: users cannot accidentally fall back to HTTP
  • Cookie protection: stops cookie theft over insecure connections
  • Browser enforcement: browsers remember to always use HTTPS
  • Preload benefits: browsers enforce HTTPS even on the very first visit

HSTS Preload List Requirements

Prerequisites

Valid HTTPS Certificate

Serve a valid certificate on all subdomains

HTTP Redirects

Redirect all HTTP traffic to HTTPS

HSTS Header on Base Domain

Serve the HSTS header on the base domain over HTTPS

Header Requirements

max-age ≥ 31536000

At least 1 year (2 years recommended)

includeSubDomains Directive

Must cover all subdomains

preload Directive

Explicitly opt in to the preload list

Example HSTS header:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Important: HSTS Preload List Commitment

Adding your domain to the HSTS preload list is a near-permanent commitment. Once preloaded, browsers refuse to connect to your domain over HTTP, even on the first visit. This gives you maximum security but requires:

  • All subdomains must support HTTPS (includeSubDomains directive)
  • Removal from the preload list takes months to propagate
  • Broken HTTPS on any subdomain will make it inaccessible
  • Test thoroughly before submitting to the preload list

Need to confirm your HTTP to HTTPS redirects and the full redirect chain too? Try the HTTP Security Checker.

1 year
Minimum max-age for the preload list
All subdomains
Must be covered before a domain can be preloaded
1st visit
Protected from the very first visit once preloaded

HSTS questions

What is HSTS?

HTTP Strict Transport Security is a response header that tells browsers to only ever connect to your site over HTTPS, so an attacker on the network cannot downgrade a visitor to plain HTTP.

What max-age should I use?

Use at least one year (31536000 seconds) once you are confident every page works over HTTPS. Start lower while testing, because browsers remember the setting for the whole max-age.

What is the HSTS preload list?

A list built into browsers of domains that must always use HTTPS, even on the very first visit. To be accepted, a domain needs max-age of at least one year, includeSubDomains, the preload directive, and HTTPS on every subdomain.

Is HSTS preloading risky?

It is hard to undo: removal from the list takes months to reach every browser. Only preload when every subdomain, including internal and legacy ones, works over HTTPS.

Is the HSTS checker free?

Yes, with no registration. It reads your HSTS header and checks your domain's preload list status.

This is one check. A full scan runs them all.

Free

The HSTS Check covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.

Covered by this check

  • HSTS header validation
  • max-age and directive analysis
  • includeSubDomains coverage check
  • HSTS preload status check
  • Preload eligibility review

Added by a full scan

  • HTTP to HTTPS redirect testing
  • SSL/TLS certificate validation
  • Security headers analysis
  • WordPress vulnerability scanning
  • Malware & script detection
  • DNS security (DNSSEC, CAA)
  • Domain reputation analysis
  • And 6+ more security checks
https://

Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.

Start free monitoring

More SSL and HTTP security tools

SSL Certificate Checker

Validate the certificate, chain and expiry of any site.

HTTP Security Checker

Test HTTP to HTTPS redirects and catch protocol downgrade risks.

Security Headers Checker

Audit CSP, HSTS and other HTTP security headers.

CSP Checker

Evaluate Content-Security-Policy effectiveness, unsafe-inline, wildcards and missing directives.

Cookie Security Checker

Audit cookies for Secure, HttpOnly and SameSite flags.