HSTS Checker
Check HTTP Strict Transport Security for any domain. Verify max-age, includeSubDomains, preload flags, and HSTS preload list membership.
What HSTS Does and Why It Exists
HSTS (RFC 6797) exists to kill one specific attack: SSL stripping. A site that redirects HTTP to HTTPS still accepts that first insecure request, and an attacker sitting on the network path — a hostile Wi-Fi hotspot, a compromised router — can intercept it, keep the victim on plain HTTP, and proxy the real HTTPS site behind the scenes while reading everything. Once a browser has seen a Strict-Transport-Security header, that window closes: the browser rewrites every HTTP URL for the domain to HTTPS internally before any request leaves the machine, and certificate errors become hard failures the user cannot click through.
The max-age directive is a countdown in seconds, refreshed every time the browser sees the header again. That persistence is the feature and the risk: a mistake stays cached in visitors' browsers until the timer runs out, and you have no remote kill switch. The safe rollout is incremental — start around max-age=300 while you verify every host, raise it to a day, then a month, and only commit to a year once HTTPS has been boring for a while. Add includeSubDomains only after auditing every subdomain, because it extends the contract to all of them.
Even a perfect header leaves the very first visit unprotected, which is what the preload list solves: domains baked directly into Chrome, Firefox, Safari, and Edge that are HTTPS-only from the first packet. To qualify at hstspreload.org you need max-age=31536000 or higher, includeSubDomains, the preload token, and a working HTTP-to-HTTPS redirect. Understand the trade before submitting: removal requires waiting for updated lists to ship inside browser releases, so escaping the preload list takes months — it is close to a one-way door.
The Directives and Decisions That Matter
max-ageHow long (in seconds) the browser enforces HTTPS-only, refreshed on every response. 31536000 (1 year) is the preload minimum; short values are for testing only.
includeSubDomainsExtends enforcement to every subdomain — including forgotten HTTP-only internal hosts. The most common source of HSTS outages; audit DNS before enabling.
preloadA consent token for the browser-embedded preload list. On its own it does nothing — you must also submit the domain at hstspreload.org and meet the requirements.
Header syntaxnginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — Apache uses Header always set; Next.js sets it via headers() in next.config.js.
First-visit gapHSTS is trust-on-first-use: the policy arrives in a response, so the very first request is unprotected. Only preloading closes this gap completely.
Rollback strategyServe max-age=0 over valid HTTPS and browsers drop the cached policy on their next visit. Preload rollback is far slower — it waits on browser release cycles.