HSTS Checker

An HSTS checker is a free online tool that fetches your website and analyzes the Strict-Transport-Security (HSTS) header. It verifies the max-age value, checks for the includeSubDomains and preload directives, and validates the HTTP-to-HTTPS redirect chain — then provides specific fix recommendations.

Enter your website URL in the HSTS checker above. We'll check your Strict-Transport-Security header, validate all directives, test your redirect chain, and tell you exactly what needs to change to achieve proper HSTS protection.

HSTS (HTTP Strict Transport Security) is a security header that tells browsers to always use HTTPS when connecting to your site. It prevents SSL stripping attacks where attackers intercept HTTP connections before they redirect to HTTPS.

Start with a short max-age (e.g., 300 seconds) for testing. Once confirmed working, increase to at least 31536000 (1 year). For HSTS preload submission, you need a minimum of 1 year with includeSubDomains.

HSTS preloading hardcodes your domain into browsers' built-in HSTS lists. This ensures HTTPS is enforced from the very first visit — before any HTTP response is received — eliminating the window where the initial request could be intercepted.

Yes, if all your subdomains support HTTPS. The includeSubDomains directive ensures HSTS applies to all subdomains, preventing attackers from using insecure subdomains to set cookies that affect the parent domain.

Yes, our HSTS checker is completely free. It analyzes your HSTS configuration in detail and is part of SecScanner's free toolkit that also checks SSL, cookies, DNS, and 60+ other security configurations.