SSL Toolkit Logo
Tools Features Compare FAQ Login

HSTS Test and HSTS Checker

Check HSTS configuration and preload list status for any domain

Checking HSTS for ...

HSTS Status
Max Age (seconds)
includeSubDomains
Preload Status

Raw HSTS Header

HSTS Preload List

Check your domain's status on the official HSTS preload list maintained by browser vendors.

Check on hstspreload.org

Error

About HSTS Preload Checker

An HSTS test checks one thing: does the site send the Strict-Transport-Security header, and is it configured safely. An HSTS checker also reports whether the domain is on the official preload list. Our free HSTS Preload Checker verifies your domain's HTTP Strict Transport Security configuration and checks if it's on the official HSTS preload list. HSTS tells browsers to only connect via HTTPS, protecting against protocol downgrade attacks. The preload list ensures browsers enforce HTTPS before the first visit.

How to Use

  1. 1Enter your domain name
  2. 2Click "Check HSTS" to verify header configuration and preload status
  3. 3Review results and follow recommendations to enable or improve HSTS

Use Cases

  • •Verify HSTS is correctly configured on your domain
  • •Check if your domain is on the browser preload list
  • •Prepare your domain for HSTS preload submission
  • •Audit HTTPS enforcement across your infrastructure

How to Enable HSTS

HSTS is just one HTTP response header. Add it to every HTTPS response, then confirm it here. Test with a short max-age before committing to a long one.

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache (needs mod_headers)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

IIS — web.config

<system.webServer><httpProtocol><customHeaders>
  <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
</customHeaders></httpProtocol></system.webServer>

Cloudflare

SSL/TLS → Edge Certificates → HTTP Strict Transport Security. Use “Enable” rather than “Max-Age” if you also want the preload token.

Before you request preload

  • Serve a valid certificate on the domain — preload does not work on IPs or bare http.
  • Redirect port 80 to HTTPS, otherwise users hit a browser interstitial on the first visit.
  • Send max-age of at least 31536000 (one year). A 30-day value is valid HSTS but is rejected by the preload list.
  • Add includeSubDomains — and make sure every subdomain has HTTPS, because it is now forced.
  • Keep a plain-HTTP fallback ready. Once a browser has seen HSTS it will refuse plain HTTP for the whole max-age window, even if you break something.

HSTS Preload Requirements

  • •max-age must be at least 31536000 (1 year)
  • •includeSubDomains directive must be present
  • •preload directive must be present
  • •HTTPS must be served on all subdomains

Frequently Asked Questions

The HSTS preload list is a list of domains distributed with major web browsers (Chrome, Firefox, Safari, Edge) that are hardcoded to only connect via HTTPS. This ensures the browser never makes an insecure HTTP connection to your domain, even on the first visit.
Your HSTS header must have max-age at least 31536000 (1 year), includeSubDomains directive, and the preload directive. After verifying your configuration with this checker, submit your domain at hstspreload.org for inclusion in the list.
Removal from the preload list is difficult and takes time. Once included, browser updates are required to remove a domain, which can take months or years to propagate. Only submit your domain when you are committed to serving HTTPS permanently.
For ordinary production use, one year (max-age=31536000) is the normal answer, and it is also the minimum required for the preload list. While you are still testing, start with max-age=300 and raise it once you are confident every page works over HTTPS. Note that browsers cap how long they actually remember the policy regardless of what you send.
Three things disqualify it: a max-age under one year, a missing includeSubDomains, or no valid certificate at submission time. Plenty of domains also simply have not been submitted yet — the list is opt-in. Check that port 80 redirects to HTTPS, because the preload submission service follows it before accepting a domain.
Only if you send includeSubDomains. Without it, each host has to be covered by its own policy, and a subdomain that has never sent the header can still be reached over plain HTTP. That flag also forces HTTPS on subdomains you may not control or may not have certificates for, which is the reason it is worth auditing your DNS first — a wrong entry here can break an internal service for every browser that has seen your policy.
Yes. HSTS only takes effect after the browser has received the header over HTTPS once, and that first request has to arrive over HTTPS to be trusted. Until then the very first visit to http:// is unprotected, which is exactly the request an attacker wants to intercept. The redirect is what closes that window; HSTS is what stops it being exploited again on later visits.
Usually the header is only on some responses. It has to be present on the HTTPS response the browser actually receives, including error pages and redirects, and it must not be set on the plain HTTP response — a browser ignores it there. This tool requests the site over plain HTTP to check, so if you only added the header inside your HTTPS virtual host you will see it reported as missing even though your config contains it.

Tips & Best Practices

Technical Details

Header: HTTP Strict Transport Security (HSTS) header analysis
Parameters: max-age, includeSubDomains, preload directives
Preload: HSTS preload list status
Output: HSTS configuration analysis with recommendations

Related Tools

SSL Certificate Checker Security Header Analyzer DNS Propagation Checker Certificate Expiry Calendar Cloudflare SSL Checker Certificate Inventory DNS History Checker