HSTS Preload Readiness
HSTS preload ensures browsers always use HTTPS for your domain by hardcoding it into browser source code via the HSTS preload list.
Why It Matters
Even with HSTS headers, the first visit to your site is vulnerable to downgrade attacks. Preloading eliminates this window by ensuring browsers never make an HTTP request to your domain.
How We Check
We verify the HSTS header has max-age of at least 31536000 (1 year), includes the 'includeSubDomains' directive, and has the 'preload' directive for preload list eligibility.
How to Fix
Set the HSTS header to: 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'. Then submit your domain at hstspreload.org. Ensure all subdomains support HTTPS first.
Related Security Checks
Check Your Website Now
Run a free security scan to check for HSTS Preload Readiness issues and 58+ other security vulnerabilities.
Scan Your Website Free