Security Tools

HSTS Checker

Check whether a website sends the Strict-Transport-Security (HSTS) header.

Enter a domain to check whether it sends the HSTS header.

More Security Tools

HTTPS Redirect Checker Content Security Policy (CSP) Checker Security Headers Checker X-Frame-Options Checker Mixed Content Detector X-Content-Type-Options Checker CORS Header Checker Referrer-Policy Checker

JustChecker monitors your security headers continuously.

What Is HSTS?

HTTP Strict Transport Security (the Strict-Transport-Security header) tells browsers to use HTTPS for a site for a set period, even if the user types http://. This tool checks whether the header is sent and shows its value.

When to Use It

After moving a site fully to HTTPS.
Before applying for the browser HSTS preload list.

How to Use It

Enter the domain.
Check the header value.

Understanding the Result

A typical value is max-age=31536000; includeSubDomains (one year). preload is only for sites submitted to the preload list.

Limitations

Only enable includeSubDomains when every subdomain supports HTTPS, and start with a short max-age while testing - browsers remember HSTS and will refuse plain HTTP until it expires.

Frequently Asked Questions

HSTS instructs the browser to automatically use https for every future visit to your domain, WITHOUT even attempting an insecure http connection first - closing a brief window of vulnerability that a server-side redirect alone can't fully eliminate.

It's how long (in seconds) the browser should remember to enforce https-only for your domain after this one response - common values range from a few months to a full year (31536000 seconds).

Preloading submits your domain to a hardcoded list built into browsers themselves, enforcing https from the very first visit ever, before any HSTS header has even been received - a stronger, but effectively permanent and hard-to-reverse, commitment.

Yes, this is a real risk - once a browser has cached your HSTS policy, it will refuse any http fallback, so if your certificate later has a genuine problem, visitors who've seen the HSTS header can't even reach an insecure fallback version.

Only if every subdomain of your domain is genuinely ready to be served exclusively over https - including it while a subdomain still relies on plain http will make that subdomain completely inaccessible to browsers that have cached the policy.

Yes - any unencrypted connection is vulnerable to interception and manipulation in transit, regardless of the specific content, so HSTS remains valuable general hardening for any production website.