Skip to main content
wp-config.org

Website and domain checks

HSTS policy checker

Understand the HSTS policy a public HTTPS address sends, with each part of it explained.

  • max-age explained
  • includeSubDomains
  • Preload notes

Free, no sign-up. Lookups and results are not saved by this site.

This tool needs JavaScript. Turn JavaScript on and reload the page.

HSTS checker

HSTS tells browsers to use only HTTPS for a website. This check reads the Strict-Transport-Security header from the final secure response and explains each part of it.

Technical references: HSTS specification (RFC 6797) (opens in a new tab) and Strict-Transport-Security header reference (opens in a new tab).

What you can do

  • Strict-Transport-Security header parsing

  • Valid, missing, turned off and malformed policies

  • max-age read safely, however large

  • includeSubDomains and preload notes

  • Warnings about the final host name and repeated headers

How to use it

  1. Enter the address

    Enter a public HTTPS address without a username, password or other private details.

  2. Run the test

    Start the test. A quick Cloudflare security check runs first, then this site checks the address and its redirects before connecting.

  3. Read the result

    Read the result, the evidence and the limits. If you change a server or CDN setting, run the test again.

How the HSTS checker works

HTTP Strict Transport Security tells browsers to use only HTTPS for a host name once they have seen a valid policy. This checker reads the first Strict-Transport-Security header from a short GET request and explains its max-age, whether it covers subdomains and the optional preload token.

Know the limits

Browsers only accept HSTS over a verified HTTPS connection and never store it for an IP address. A missing header does not rule out a policy inherited from a parent domain, cached in a browser or on a preload list. max-age=0 asks browsers to forget the host's policy but cannot remove a parent domain's or preload list's protection. The preload token is not proof of being on a browser's preload list, and the lists are not checked.

Frequently asked questions

What does HSTS max-age mean?

It is how many seconds a browser should remember the policy after getting it over a verified HTTPS connection. A value of 0 asks the browser to forget the stored policy for that host.

What does includeSubDomains do?

It applies the policy to the host's subdomains as well. Every affected subdomain needs working HTTPS first. This test does not check your subdomains.

Does preload mean the site is on a browser preload list?

No. The preload token is an opt-in signal that preload programs look for. This checker does not look up browser preload lists or confirm that a site can be submitted.

Why can a missing HSTS header still leave a browser protected?

Browsers may already have a stored policy, inherit one from a parent domain or use a preload list. This test looks at one server response and not at any browser's stored state.

Are these results for my origin server or my CDN?

The checker connects to the public URL. A CDN, reverse proxy or load balancer may answer instead, so the result does not show how your origin server itself is set up.

What is sent when I run a test?

Your URL and a fresh Cloudflare Turnstile response are sent to this site. After the security check, our server makes a few limited public requests. Page contents and cookies are not returned or saved.

Related tools

  • HTTP headers

    Inspect HTTP response headers and redirects.

  • Nginx

    Prepare routing, HTTPS and cache configuration.

  • DNS lookup

    Review DNS records and email policies.