Free tool · No sign-up
HSTS checker
Updated 2 November 2026
Enter a domain to read its Strict-Transport-Security header, check max-age, includeSubDomains and preload, confirm that http:// redirects to https://, and see whether the domain is on the browsers' HSTS preload list.
Want every page checked, not just this one? See the full audit →
What HSTS does
HTTP Strict Transport Security tells a browser: for the next max-age seconds, only ever contact this domain over HTTPS. After the first visit, the browser upgrades typed or linked http:// addresses itself, before any request leaves the device. That closes the window an attacker on public Wi-Fi would otherwise use to intercept the first plain-http request and keep the visitor on an unencrypted copy of your site, an attack known as SSL stripping.
What the checker looks at
- The header itself. Browsers honour it only on HTTPS responses with a valid certificate.
- max-age. One year (31536000 seconds) is the common recommendation and the minimum for preloading. Six months is acceptable; a few minutes gives almost no protection.
- includeSubDomains. Extends the rule to every subdomain. Add it only after you've confirmed that every subdomain, including old ones like mail or staging, works over HTTPS.
- preload. A signal that you want the domain built into browsers' preload lists, so even the very first visit is HTTPS-only.
- http:// redirect. Plain-http requests should get a permanent 301 or 308 redirect to https://.
Rolling it out safely
Start with a short max-age such as 300 seconds, check your site and subdomains, then raise it to a week, a month and finally a year. HSTS can't be undone quickly: a browser that saw a one-year header will refuse plain http for a year. Preloading is even stickier, because removal from the list takes months to reach users. Only add preload and submit at hstspreload.org when you're certain every current and future subdomain will serve HTTPS.
Common setups
On Cloudflare, HSTS is under SSL/TLS, Edge Certificates. In Nginx, add add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the HTTPS server block. On Netlify or Cloudflare Pages, add the header in a _headers file. The free headers check generates snippets for these and other hosts.
Frequently asked questions
What max-age should I use for HSTS?
Use 31536000 (one year) once you're confident HTTPS works everywhere. Ramp up from a few minutes if you're unsure.
Does HSTS replace the http to https redirect?
No. You need both: the redirect covers first-time visitors and browsers without the HSTS entry, and HSTS protects every visit after that.
What happens if my certificate expires with HSTS on?
Browsers won't let visitors click through the warning, so the site becomes unreachable until the certificate is fixed. Automate renewals.
Should every site be preloaded?
Only if you control every subdomain and will keep HTTPS on all of them. A 1-year HSTS header without preload is already strong protection.