SSL HSTS Preload Checker

Check HSTS configuration and preload list status for any domain

Checking HSTS for ...

HSTS Status

Max Age (seconds)

includeSubDomains

Preload Status

Raw HSTS Header

HSTS Preload List

Check your domain's status on the official HSTS preload list maintained by browser vendors.

Check on hstspreload.org

Error

About HSTS Preload Checker

Our free HSTS Preload Checker verifies your domain's HTTP Strict Transport Security configuration and checks if it's on the official HSTS preload list. HSTS tells browsers to only connect via HTTPS, protecting against protocol downgrade attacks. The preload list ensures browsers enforce HTTPS before the first visit.

How to Use

1Enter your domain name
2Click "Check HSTS" to verify header configuration and preload status
3Review results and follow recommendations to enable or improve HSTS

Use Cases

•Verify HSTS is correctly configured on your domain
•Check if your domain is on the browser preload list
•Prepare your domain for HSTS preload submission
•Audit HTTPS enforcement across your infrastructure

HSTS Preload Requirements

•max-age must be at least 31536000 (1 year)
•includeSubDomains directive must be present
•preload directive must be present
•HTTPS must be served on all subdomains

Frequently Asked Questions

The HSTS preload list is a list of domains distributed with major web browsers (Chrome, Firefox, Safari, Edge) that are hardcoded to only connect via HTTPS. This ensures the browser never makes an insecure HTTP connection to your domain, even on the first visit.

Your HSTS header must have max-age at least 31536000 (1 year), includeSubDomains directive, and the preload directive. After verifying your configuration with this checker, submit your domain at hstspreload.org for inclusion in the list.

Removal from the preload list is difficult and takes time. Once included, browser updates are required to remove a domain, which can take months or years to propagate. Only submit your domain when you are committed to serving HTTPS permanently.

Tips & Best Practices

•Enable HSTS with appropriate max-age for production domains
•Use includeSubDomains to protect all subdomains
•Consider HSTS preloading for maximum protection
•Test HSTS configuration before enabling in production

Technical Details

Header: HTTP Strict Transport Security (HSTS) header analysis
Parameters: max-age, includeSubDomains, preload directives
Preload: HSTS preload list status
Output: HSTS configuration analysis with recommendations

Related Tools

SSL Certificate Checker Security Header Analyzer DNS Propagation Checker Certificate Expiry Calendar Cloudflare SSL Checker Certificate Inventory DNS History Checker