HSTS Checker

Check whether a website enforces HTTPS-only connections via the HSTS header, and how it's configured.

About this tool

HSTS (HTTP Strict Transport Security) tells a visitor's browser to only ever connect to a domain over HTTPS for a set period — even if a user types "http://" or follows an old http:// link, the browser upgrades the connection itself before making any request. This closes a real gap: without HSTS, that very first request can still go out over plain HTTP and be intercepted before any redirect to HTTPS happens.

What each part means

  • max-age — how long (in seconds) the browser should remember to enforce HTTPS for this domain after seeing the header once.
  • includeSubDomains — extends the same enforcement to every subdomain, not just the exact domain that sent the header.
  • preload — a signal requesting inclusion in browsers' built-in HSTS preload list, which enforces HTTPS from the very first visit ever, before the header has even been seen once. Actual inclusion requires submitting the domain at hstspreload.org — the header alone doesn't add it.

Related tools:

Security Headers Checker SSL Checker