HSTS Checker

Check whether a website enforces HTTPS-only connections via the HSTS header, and how it's configured.

What is an HSTS checker?

An HSTS checker tells you whether a website uses HTTP Strict Transport Security and how it is configured. HSTS is a response header, Strict-Transport-Security, that instructs browsers to connect to the site only over HTTPS for a set period. After the first secure visit, the browser upgrades every http:// link to HTTPS by itself, before any request leaves the device.

That closes the gap where an attacker on the same network could intercept the first insecure request and keep a visitor on plain HTTP.

How the HSTS check works

The tool requests the address you enter, follows redirects and checks two things: whether the final response is served over HTTPS, and whether it includes the HSTS header. If the header is present, its parts are read out separately:

  • max-age: how many seconds browsers should remember the rule, also shown in days.
  • includeSubDomains: whether the rule covers every subdomain as well.
  • preload: whether the site asks to be added to the browser preload list.

The raw header is shown as well, exactly as received.

How to check HSTS on your site

  1. Enter your domain, for example example.com.
  2. Press Check HSTS.
  3. Confirm that HTTPS is in use and the header is present.
  4. Review max-age, includeSubDomains and preload against your plans.

Reading the HSTS results

max-age

A common production value is 31536000, one year. Short values such as 300 seconds are useful while testing. A value of 0 tells browsers to forget the rule. Browsers refresh the stored rule each time they receive the header, so the period keeps rolling forward.

includeSubDomains

Only enable this if every subdomain, including internal or older ones, works on HTTPS; otherwise those subdomains will become unreachable in browsers that saw the rule.

preload

The preload list is built into browsers, so even the very first visit uses HTTPS. The directive alone does not mean a domain is on the list. Submission happens separately at hstspreload.org, which also lists the requirements.

How HSTS protects visitors

Without HSTS, a visitor who types example.com sends a first request over plain HTTP and relies on the server's redirect to reach HTTPS. On an untrusted network, such as public Wi-Fi, an attacker can intercept that request and keep the visitor on an insecure copy of the site, an attack known as SSL stripping. With HSTS stored in the browser, the insecure request is never sent. Browsers also stop visitors clicking past certificate warnings on HSTS sites.

Rolling out HSTS safely

Start with a short max-age, such as five minutes, and check that every page and subdomain works on HTTPS. Increase it to a week, then a month, then a year. Only then consider includeSubDomains and preload. Because browsers remember the rule, a mistake cannot be undone quickly for visitors who have already seen it.

Common uses

  • Confirming HSTS is live after a server or CDN change.
  • Checking a site meets preload requirements before submitting it.
  • Auditing HTTPS enforcement across several domains.

Common problems and fixes

Header not detected. Add Strict-Transport-Security: max-age=31536000 to HTTPS responses in your server or CDN settings. Browsers ignore the header on plain HTTP responses.

HTTPS not in use. HSTS needs a working certificate first. Fix HTTPS with the SSL Checker, then add the header.

A subdomain stopped working after enabling HSTS. includeSubDomains forced HTTPS on a subdomain without a valid certificate. Add a certificate for it, or remove includeSubDomains and wait for the old max-age to run out.

max-age is 0. This switches HSTS off. Set a real value unless you are deliberately removing it.

Related tools

Frequently asked questions

What does HSTS do?

HSTS, or HTTP Strict Transport Security, tells browsers to connect to a site only over HTTPS for a set time. After the first secure visit, the browser changes every http:// address for that site to https:// before sending anything, which protects visitors from downgrade attacks on public networks.

What max-age should I use for HSTS?

For a site that is fully on HTTPS, one year, 31536000 seconds, is the common recommendation and the minimum for the preload list. When first enabling HSTS, start much lower, such as 300 seconds, and raise it in steps once you are sure every page works over HTTPS.

Is it safe to use includeSubDomains?

Only when every subdomain supports HTTPS, including internal tools, mail web interfaces and older services. Browsers that see the rule will refuse plain HTTP on all of them for the max-age period. Check each subdomain first, because the rule cannot be withdrawn quickly from browsers that have stored it.

Does the preload directive mean my site is preloaded?

No. The directive only says the site agrees to be included. The domain must be submitted at hstspreload.org and accepted, and then it ships in browser updates, which takes time. This tool reports whether the directive is present, not whether the domain is on the list.

Why is my HSTS header not detected?

The header may only be set for some pages, may be removed by a CDN or proxy, or may only be sent on HTTP responses, where browsers ignore it. Make sure it is sent on the final HTTPS response. The tool checks the page you entered after following any redirects.

How do I remove HSTS from my site?

Send the header with max-age=0 over HTTPS. Browsers that receive it forget the rule. Browsers that do not visit again keep enforcing HTTPS until their stored max-age runs out. If the domain is on the preload list, removal must also be requested at hstspreload.org and takes months.

Do I still need an HTTP to HTTPS redirect with HSTS?

Yes. HSTS only works after a browser has received the header over HTTPS, so first-time visitors, search engines and older clients still rely on the redirect. Keep a permanent redirect from HTTP to HTTPS and use HSTS on top of it.