--- title: Free HSTS Checker description: Check a site's HTTP Strict Transport Security header — whether it is sent at all, its max-age, includeSubDomains and preload directives — and whether the policy meets the requirements for the browser preload list. Find the subdomain that still lets a first visit happen over plain HTTP. canonical: https://watchfor.io/hsts-checker --- [Back to all free tools](/free-tools) # HSTS Checker Check a site's HTTP Strict Transport Security header — whether it is sent at all, its max-age, includeSubDomains and preload directives — and whether the policy meets the requirements for the browser preload list. Find the subdomain that still lets a first visit happen over plain HTTP. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is HSTS Checker ? HTTP Strict Transport Security is a single response header — Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — that tells a browser to use HTTPS for this host, and nothing else, for the stated number of seconds. Once seen, the browser rewrites every http:// link and typed address to https:// before sending anything, and refuses to let the user click through a certificate warning. It closes the gap that a redirect from HTTP to HTTPS leaves open: the first plain-text request that can be intercepted before the redirect arrives. This tool fetches a URL from a real probe and evaluates the HSTS header the way a browser and the preload list do: is it present, is it served over HTTPS (it's ignored otherwise), is max-age long enough, does it cover subdomains, does it carry the preload token — and therefore whether the site qualifies for the Chrome/Firefox/Safari preload list that hard-codes HTTPS-only before the first visit ever happens. ## How it works The check follows the rules browsers apply (RFC 6797) and the preload list's submission requirements: - 1 Fetch over HTTPS — Browsers only honour HSTS received on a secure connection. The tool follows the redirect from http:// if you start there, and notes when the final response wasn't HTTPS. - 2 Parse the directives — max-age in seconds (required), includeSubDomains (optional but required for preload), preload (the site's consent to be listed). Anything else is ignored, as browsers do. - 3 Judge against the preload bar — hstspreload.org requires: HTTPS with a valid certificate, HTTP redirecting to HTTPS on the same host, max-age ≥ 31536000 (1 year), includeSubDomains , and preload . The verdict lists which of those are met. Preloading is a commitment: every subdomain, including internal ones people forgot, must work over HTTPS forever, and removal from the list takes months. ## When you'd use it ### After enabling HTTPS everywhere The redirect is in place; now make it stick. Add HSTS with a short max-age (a day), verify with this tool, raise it to a year once nothing breaks. ### Before submitting to the preload list The submission form rejects sites that miss any requirement. Check here first; the verdicts map one-to-one to the form's error messages. ### Finding the subdomain that isn't covered includeSubDomains on the apex covers everything below it — but a user who visits app.example.com first never sees the apex header. Each entry point should send it, and the preload list solves it for good. ### Security questionnaire or audit "Does the application enforce HSTS with a max-age of at least one year?" is a standard question. This check is the evidence. ## Reading the result ### max-age Seconds the browser remembers the policy, refreshed on every HTTPS response. 31536000 (1 year) is the norm and the preload minimum; 63072000 (2 years) is common. Shown as days for readability. ### includeSubDomains Extends the policy to every subdomain. Required for preload. Dangerous only if some subdomain genuinely can't do HTTPS — find it before, not after. ### preload A token that means "you may add me to the browsers' built-in list". It does nothing by itself; the submission at hstspreload.org does. Without it the first visit is still unprotected. ### Preload-ready All conditions met as far as the header goes. The remaining requirement — HTTP on port 80 redirecting to HTTPS on the same host — is visible in the redirect checker. ## Check it yourself curl -sI https://example.com | grep -i strict-transport-security No output means no header on that response. Check the URL the redirect actually lands on. ## Common pitfalls ### Sending HSTS over HTTP Ignored by browsers. The header must arrive on the HTTPS response; the HTTP side should only redirect. ### A long max-age on a site that can't keep HTTPS If the certificate lapses or a subdomain must go back to HTTP, users with the policy cached are locked out for the remaining max-age with no bypass. Start short; grow when confident. ### Preloading before every subdomain is ready Internal tools, the old blog on a shared host, the mail webclient on plain HTTP — all become unreachable in every preloaded browser. Inventory subdomains first. ## Run HSTS Checker on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What is the recommended HSTS header? Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — one year, all subdomains, preload consent. Send it on every HTTPS response. What does HSTS preload mean? Browsers ship a built-in list of domains that are HTTPS-only. A preloaded domain never makes a plain HTTP request, not even the first one from a fresh install. You submit at hstspreload.org after meeting the requirements; inclusion arrives with the next browser releases. Does HSTS replace the HTTP to HTTPS redirect? No — the redirect is still needed for the very first visit (unless preloaded) and for clients that ignore HSTS. Both together: redirect on port 80, HSTS on port 443. How do I remove HSTS? Send max-age=0 over HTTPS; browsers drop the policy on the next visit. Removal from the preload list is a separate request and takes a browser release cycle or more. Why does the checker say the header is missing when I set it? It was set on the origin but stripped by a CDN or proxy, set only on some paths, sent only over HTTP, or you're checking a URL that redirects elsewhere before the header is sent. The full header list shows what the final response carries. Is HSTS enough to make a site secure? It makes HTTPS mandatory. It doesn't fix a weak TLS configuration, a missing CSP, or application bugs. It's one header in the set the security headers checker audits. ## Related web tools - [HTTP HeadersInspect response headers, status, redirect chain and security headers.](/http-header-checker) - [MCP Server CheckerTest a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.](/mcp-server-checker) - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) - [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.](/ssl-grade-checker) --- Canonical page: https://watchfor.io/hsts-checker · Site guide: https://watchfor.io/llms.txt