HSTS Checker
Check the Strict-Transport-Security header a site sends: whether browsers will accept it, how long it lasts, whether it covers subdomains and whether it meets the hstspreload.org requirements.
Start a check
- Non-Intrusive Scan
- HSTS preload eligibility
What is an HSTS check?
HTTP Strict Transport Security (HSTS, RFC 6797) is a response header that tells browsers to use only HTTPS for a host for max-age seconds, and for its subdomains too when it includes includeSubDomains. An HSTS check fetches the site over HTTPS, reads the header and confirms it follows the RFC 6797 grammar, because browsers ignore a malformed header entirely.
The checker runs the same scan as the Security Headers Checker, so each check is also saved as a full security headers report with a shareable link.
What the HSTS checker reports
The checker reads the Strict-Transport-Security header from the HTTPS response and parses it the way RFC 6797 tells browsers to.
max-age
How long, in seconds, browsers keep using HTTPS for the host. One year (31536000) is the minimum for the preload list. max-age=0 tells browsers to forget the policy.
includeSubDomains
Applies the policy to every subdomain. Check that every subdomain serves HTTPS before you add it.
preload
Asks to be added to the browser preload list. hstspreload.org recommends HSTS but not preloading, because browsers such as Chrome and Safari already upgrade HTTP navigations to HTTPS, and removal from the list is slow.
Syntax
max-age is required and each directive may appear only once. Browsers ignore a header that breaks these rules, and when a response sends several HSTS headers they use only the first.
HSTS preload requirements
hstspreload.org accepts a domain only if it serves a valid certificate, redirects HTTP to HTTPS on the same host, serves every subdomain over HTTPS, and sends an HSTS header on the base domain with a max-age of at least 31536000, includeSubDomains and preload. The checker tests the requirements it can see and marks the rest for you to check. hstspreload.org makes the final decision and does not document a public API, so the checker does not look up whether a domain is already on the list.
How the A+ to F grade works
A max-age of at least one year scores 90, at least 30 days 75, at least one day 60, and anything shorter 45. includeSubDomains adds 10. A missing or malformed header, or max-age=0, scores 0. The preload directive adds nothing, because hstspreload.org does not recommend preloading.
- A+
- 95-100
- A
- 85-94
- B
- 70-84
- C
- 55-69
- D
- 40-54
- F
- 0-39
Related checks and next steps
- HTTP Security Headers Checker
Grade HSTS with CSP, X-Frame-Options and seven more response headers.
- CSP Evaluator
Check the Content-Security-Policy the same site sends.
- Cloudflare Checker
See whether the site's traffic goes through Cloudflare.
- Website Security Check
A broader scan of a site you own, with email verification.
Managed Cloudflare
Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.
Explore Managed CloudflareManaged SOC
Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.
Explore Managed SOCSources
Questions
HSTS checker FAQ
What is a good HSTS header?
max-age=31536000; includeSubDomains is a common target once every subdomain serves HTTPS. The example on hstspreload.org, for sites that choose to preload, is max-age=63072000; includeSubDomains; preload.HTTP Security Headers Checker
Should I preload my domain?
Only after weighing it carefully. hstspreload.org says that HSTS preloading is not recommended, that a removal takes months to reach users, and that tools should not add the preload directive by default. Preloading covers every subdomain, including internal ones.
How do I roll out HSTS safely?
hstspreload.org suggests checking that every subdomain works over HTTPS, then raising max-age in stages (5 minutes, 1 week, 1 month) with includeSubDomains, waiting the full max-age of each stage and watching for problems before moving on.
Why does the checker say my header is invalid?
RFC 6797 requires max-age and allows each directive only once. Browsers ignore a header that breaks the grammar, for example one with two max-age directives or a max-age that is not a whole number of seconds.
Does HSTS on www cover the base domain?
No. HSTS applies to the host that sent it and, with includeSubDomains, to that host's subdomains. Set it on the base domain to cover everything; that is also where hstspreload.org checks it.
Does an HSTS header over plain HTTP count?
No. RFC 6797 tells browsers to ignore HSTS headers received over HTTP. The policy takes effect after a browser has loaded the site over HTTPS once, unless the domain is preloaded.
