HSTS Checker

HSTS (HTTP Strict Transport Security) is a security policy that instructs browsers to only connect to your site over HTTPS, never HTTP, for a specified duration. Once a browser receives the Strict-Transport-Security header, it automatically upgrades all future requests to HTTPS — even if the user types http:// or clicks an HTTP link. This eliminates SSL stripping attacks where an attacker intercepts the initial HTTP request before the HTTPS redirect.

The max-age directive specifies how many seconds the browser should remember to enforce HTTPS for the site. A value of 31536000 equals one year. During this period, the browser will refuse to connect over plain HTTP. If you need to revert to HTTP (e.g. your SSL certificate expires), you must either wait for max-age to expire or serve a Strict-Transport-Security header with max-age=0 before removing HTTPS — otherwise users with the cached policy will be unable to reach your site.

HSTS preloading is a browser-maintained list of domains that are hardcoded to require HTTPS before any first visit. Unlike a regular HSTS header — which only protects users after their first visit — preloading protects users on their very first connection. To be eligible, your site must serve HSTS with max-age of at least 31536000, includeSubDomains, and the preload directive. Submit via hstspreload.org. Removal from the list takes months, so only preload if you are fully committed to HTTPS on all subdomains.

Use includeSubDomains only if every subdomain of your domain is reachable over HTTPS. If any subdomain (mail.example.com, ftp.example.com, etc.) does not have a valid SSL certificate, adding includeSubDomains will make those subdomains unreachable for users whose browsers have cached the HSTS policy. Audit all your subdomains for HTTPS coverage before enabling this directive.