What is the HSTS header?

HTTP Strict-Transport-Security (HSTS) is a response header that tells browsers to only connect to your site over HTTPS for a set period. Once seen, the browser refuses plain HTTP and automatically upgrades every request to a secure connection.

How do I use this HSTS checker?

Enter a domain or URL and the tool requests the site over HTTPS and reads back its Strict-Transport-Security response header. It then shows whether the header is present and breaks down its directives such as max-age, includeSubDomains and preload.

Why does HSTS matter for my site?

HSTS defends against protocol-downgrade and SSL-stripping attacks by removing the insecure HTTP entry point after the first visit. It also cuts an unnecessary HTTP-to-HTTPS redirect, so pages load slightly faster and more securely.

How do I read the max-age, includeSubDomains and preload values?

max-age is how long, in seconds, the browser enforces HTTPS (31536000 equals one year, the common recommendation). includeSubDomains extends the rule to every subdomain, and preload signals you want the domain baked into browsers' built-in HSTS lists.

Why does the checker show no HSTS header when my site uses HTTPS?

The header must be sent by the server on HTTPS responses, and browsers ignore it if delivered over plain HTTP, so having a valid certificate alone is not enough. If it is missing, add a Strict-Transport-Security header in your web server or CDN configuration and re-check.

HSTS Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

The Strict-Transport-Security header tells browsers to only ever contact your site over HTTPS for max-age seconds, eliminating the brief unprotected window on http:// requests that attackers can exploit.

How to read your result

Healthy: the header present on HTTPS responses with max-age of at least a year (31536000), ideally includeSubDomains. The header on HTTP responses is ignored by browsers — it must be served over HTTPS.

Common problems and how to fix them

No HSTS header

How it shows up: Every first visit and every typed http:// URL makes one unprotected request that a network attacker can intercept and keep on plain HTTP.

How to fix it: Add Strict-Transport-Security: max-age=31536000; includeSubDomains at the web server or CDN. Start with a shorter max-age (e.g. 86400) if you are unsure every subdomain serves HTTPS, then raise it.

max-age too short

How it shows up: Scanners score the site down; protection lapses for infrequent visitors.

How to fix it: Raise max-age to at least 31536000 (one year) once HTTPS is stable everywhere the policy covers.

includeSubDomains broke an HTTP-only subdomain

How it shows up: Some internal or legacy subdomain became unreachable for anyone who visited the main site — browsers force HTTPS on it.

How to fix it: Either serve that subdomain over HTTPS (best) or remove includeSubDomains and wait for cached policies to expire — which takes as long as the old max-age. This is why includeSubDomains deserves an audit first.

Frequently asked questions

What is the HSTS header?: HTTP Strict-Transport-Security (HSTS) is a response header that tells browsers to only connect to your site over HTTPS for a set period. Once seen, the browser refuses plain HTTP and automatically upgrades every request to a secure connection.
How do I use this HSTS checker?: Enter a domain or URL and the tool requests the site over HTTPS and reads back its Strict-Transport-Security response header. It then shows whether the header is present and breaks down its directives such as max-age, includeSubDomains and preload.
Why does HSTS matter for my site?: HSTS defends against protocol-downgrade and SSL-stripping attacks by removing the insecure HTTP entry point after the first visit. It also cuts an unnecessary HTTP-to-HTTPS redirect, so pages load slightly faster and more securely.
How do I read the max-age, includeSubDomains and preload values?: max-age is how long, in seconds, the browser enforces HTTPS (31536000 equals one year, the common recommendation). includeSubDomains extends the rule to every subdomain, and preload signals you want the domain baked into browsers' built-in HSTS lists.
Why does the checker show no HSTS header when my site uses HTTPS?: The header must be sent by the server on HTTPS responses, and browsers ignore it if delivered over plain HTTP, so having a valid certificate alone is not enough. If it is missing, add a Strict-Transport-Security header in your web server or CDN configuration and re-check.