中文

Check

HSTS checker

Check a site's Strict-Transport-Security header and whether it is ready for the browser HSTS preload list.

Last verified

The HSTS checker fetches a site over HTTPS and shows its Strict-Transport-Security header. Enter a domain and press Check HSTS: the tool parses max-age, includeSubDomains and preload and ticks off the requirements of the browser preload list.

How to use it

  1. Enter the domain, for example example.com. Test the bare domain: preload submissions are made for the registered domain.
  2. Press Check HSTS.
  3. Fix any requirement that is not met, then check again.

What HSTS does

When a browser receives a valid HSTS header over HTTPS, it remembers for max-age seconds that the host must only be reached over HTTPS. Typed http:// links are upgraded before any request leaves the browser, and certificate errors can no longer be clicked through. includeSubDomains extends the rule to every subdomain.

A typical header:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Preload requirements

The HSTS preload list is compiled into Chrome, Firefox, Safari and Edge, so even the very first visit uses HTTPS. To be accepted, a domain needs:

  1. A valid certificate.
  2. A redirect from HTTP to HTTPS on the same host.
  3. HTTPS on all subdomains.
  4. An HSTS header on the base domain with max-age of at least 31536000, includeSubDomains and preload.

The TLS config generator writes the header for Nginx, Apache, Caddy, HAProxy, IIS, Tomcat, Node.js and more. Before enabling HSTS, make sure no page loads insecure resources; the mixed content scanner finds them.

FAQ

What max-age should I use?

Start low (for example 300 seconds) while you confirm every page and subdomain works over HTTPS, then raise it. Long-term values are one year (31536000) or two years (63072000); the preload list requires at least one year.

Is preloading reversible?

Only slowly. You can request removal at hstspreload.org, but the change has to ship in new browser releases and users on old versions keep the entry. Make sure every subdomain, including internal ones that use the public domain, supports HTTPS before you submit.

Should the header be sent over HTTP too?

Browsers ignore Strict-Transport-Security received over plain HTTP. Send it on HTTPS responses and redirect HTTP to HTTPS.

Sources

  1. RFC 6797: HTTP Strict Transport Security
  2. HSTS preload list submission
  3. MDN: Strict-Transport-Security