How do I check if HSTS is enabled on my site?

Enter your URL into the HSTS checker to verify the Strict-Transport-Security header.

HSTS (HTTP Strict Transport Security) is a header that tells browsers to only connect to a site over HTTPS, blocking downgrade attacks.

Why should I use HSTS?

HSTS prevents protocol-downgrade attacks, builds visitor trust, and is a positive security signal for SEO.

How do I enable HSTS?

Add the Strict-Transport-Security header with a long max-age on your server or CDN, include subdomains, and consider HSTS preload submission.

WEBSITE SECURITY TOOLS · FREE ONLINE TOOL

HSTS Checker

Deep analysis of your Strict-Transport-Security deployment and preload readinessThe most dangerous visit to your website is the first one, before the browser learns your site uses HTTPS. This checker verifies your HSTS header is present and parses exactly what it promises.

✓ Free to use✓ No sign-up✓ Ready in your browser

// HSTS CHECKER · GET STARTED

Use HSTS Checker

Deep analysis of your Strict-Transport-Security deployment and preload readiness

// HSTS CHECKER · AT A GLANCE

HSTS Checker: what to know first.

Deep analysis of your Strict-Transport-Security deployment and preload readiness

01
HSTS is one of the simplest high-impact security headers a site can deploy, yet it is easy to get subtly wrong: a short max-age, a missing includeSubDomains, or a redirect chain that drops the header on one hop can all quietly undermine the protection. The HSTS Checker goes deeper than a simple header lookup. It follows every redirect, inspects the policy on each HTTPS hop, parses max-age, includeSubDomains and the preload directive, and verifies the HTTP to HTTPS upgrade that protects first-tim
02
Each deployment is graded from A to F with plain-language findings, so you know exactly what to change. The tool also evaluates preload readiness against the same rules the hstspreload.org submission form enforces, so by the time you submit your domain there should be no surprises.

// HSTS CHECKER · HOW IT WORKS

How to use the HSTS Checker

Enter URL

Enter the website URL you want to test (e.g. https://example.com).

Trace the chain

Click "Check HSTS" and wait while the redirect chain is traced.

Review the grade

Review the A to F grade, the directive breakdown, and the preload-readiness verdict.

// HSTS CHECKER · ABOUT THIS TOOL

About the HSTS Checker

The HSTS Checker goes deeper than a simple header lookup: it follows every redirect, inspects the policy on each HTTPS hop, parses max-age, includeSubDomains and the preload directive, and verifies the HTTP to HTTPS upgrade.

Each deployment is graded from A to F with plain-language findings, and preload readiness is checked against the same rules the hstspreload.org submission form enforces, so there should be no surprises when you submit your domain.

Where it helps most

When one header has to be exactly right.

After enabling HSTS

Confirm the header survived your CDN and server configuration right after you turn it on.

Before preload submission

Verify everything before joining the preload list, since removal can take months to undo.

Client audits

Check HTTPS enforcement as a line item during security audits of client sites.

Subdomain coverage checks

Confirm includeSubDomains actually protects api. and app. subdomains, not just the main domain.

Reading the report

What the checker looks for.

max-age long enough

At least a year (31536000); a max-age measured in days leaves visitors unprotected most of the time.

includeSubDomains set

Without it, api. and app. subdomains stay exposed to downgrade attacks.

Preload readiness

Preload protects even first visits, but premature submission is notoriously hard to undo.

The first-visit gap

HSTS only protects repeat visitors until the browser sees the header once, which is why preload matters for high-value sites.

HSTS Checker: built for trust

One header, verified properly, removes an entire class of downgrade attacks. No signup, results in seconds.

// HSTS CHECKER · COMMON QUESTIONS

HSTS Checker FAQs

What is HSTS in simple terms?

It is a response header telling browsers to only ever connect to your site over HTTPS, automatically upgrading any HTTP attempt. Once set, it also removes the "proceed anyway" click-through option on certificate warnings, which protects users from themselves.

What should my HSTS max-age be?

What does HSTS preload mean?

Can HSTS break my website?

tools-guide

Security Headers Checker: Grade Your Site's Defenses

Free security headers checker. Instantly scan HSTS, CSP, X-Frame-Options and more on any site, get an A to F grade and clear steps to fix every website gap.

Read article →