# HSTS Checker: Test Strict-Transport-Security and Preload

> Check a site's Strict-Transport-Security header: max-age, includeSubDomains and preload, and whether it meets the HSTS preload list requirements.

Source: https://ssl.sh/tools/hsts-checker/
Last updated: 2026-11-10

Check a site's Strict-Transport-Security header and whether it is ready for the browser HSTS preload list.

The HSTS checker fetches a site over HTTPS and shows its `Strict-Transport-Security` header. Enter a domain and press **Check HSTS**: the tool parses `max-age`, `includeSubDomains` and `preload` and ticks off the requirements of the browser preload list.

## How to use it

1. Enter the domain, for example `example.com`. Test the bare domain: preload submissions are made for the registered domain.
2. Press **Check HSTS**.
3. Fix any requirement that is not met, then check again.

## What HSTS does

When a browser receives a valid HSTS header over HTTPS, it remembers for `max-age` seconds that the host must only be reached over HTTPS. Typed `http://` links are upgraded before any request leaves the browser, and certificate errors can no longer be clicked through. `includeSubDomains` extends the rule to every subdomain.

A typical header:

```text
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
```

## Preload requirements

The [HSTS preload list](https://ssl.sh/glossary/hsts-preload/) is compiled into Chrome, Firefox, Safari and Edge, so even the very first visit uses HTTPS. To be accepted, a domain needs:

1. A valid certificate.
2. A redirect from HTTP to HTTPS on the same host.
3. HTTPS on all subdomains.
4. An HSTS header on the base domain with `max-age` of at least 31536000, `includeSubDomains` and `preload`.

The [TLS config generator](https://ssl.sh/tools/tls-config-generator/) writes the header for Nginx, Apache, Caddy, HAProxy, IIS, Tomcat, Node.js and more. Before enabling HSTS, make sure no page loads insecure resources; the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) finds them.


## FAQ

**What max-age should I use?**

Start low (for example 300 seconds) while you confirm every page and subdomain works over HTTPS, then raise it. Long-term values are one year (31536000) or two years (63072000); the preload list requires at least one year.

**Is preloading reversible?**

Only slowly. You can request removal at hstspreload.org, but the change has to ship in new browser releases and users on old versions keep the entry. Make sure every subdomain, including internal ones that use the public domain, supports HTTPS before you submit.

**Should the header be sent over HTTP too?**

Browsers ignore Strict-Transport-Security received over plain HTTP. Send it on HTTPS responses and redirect HTTP to HTTPS.