HSTS checker

What the HSTS checker does

This tool requests a website and checks whether the response includes the HTTP Strict Transport Security header. It displays the header value and indicates whether the header is present and considered valid.

HSTS is a security policy delivered through the Strict-Transport-Security response header. When a browser receives it over HTTPS, it remembers that the site should only be accessed over HTTPS for a specified period. Subsequent requests are upgraded to HTTPS automatically, even if a link uses plain HTTP.

Why HSTS matters

Without HSTS, a user who types a bare domain or follows an HTTP link may send an initial request over plain HTTP before being redirected to HTTPS. That first request is vulnerable to interception, and the redirect itself can be manipulated. HSTS closes this gap by instructing the browser to skip HTTP entirely for the configured period.

HSTS also protects against certain downgrade attacks and cookie hijacking scenarios. It is a relatively simple header to deploy, yet it meaningfully strengthens transport security for returning visitors.

How to read the header

The core directive is max-age, expressed in seconds. A value of 31536000 represents one year. A value of zero disables HSTS. The header may also include includeSubDomains, which extends the policy to all subdomains, and preload, which signals eligibility for browser preload lists.

The checker marks the header valid or invalid. Validity generally depends on the presence of a properly formed max-age directive. A header that is missing entirely means HSTS is not enabled for that response.

Deployment cautions

• Start with a short max-age. A long max-age is difficult to undo if a subdomain cannot serve HTTPS.
• Audit subdomains before includeSubDomains. The directive applies to every subdomain, including internal or legacy ones.
• Preload is a long-term commitment. Removal from preload lists takes time, so enable it only when you are confident.
• Serve the header on HTTPS responses. Browsers ignore HSTS headers delivered over plain HTTP.

Practical workflow

Confirm the header on the main domain and on representative subdomains. Check that HTTPS works reliably everywhere before increasing max-age. After changes, verify the header again and consider using browser developer tools to confirm the policy is stored. For sites planning preload, review the requirements carefully before submitting.

Limitations

The checker reports the header on the response it receives. It does not test browser behavior, does not verify preload list status, and cannot confirm that every subdomain supports HTTPS.