About this tool
Inspect HSTS before HTTPS launches, preload submissions, or security audits so transport security directives are visible on the final response.
HSTS Header Checker focuses on the Strict-Transport-Security response header that tells browsers to keep using HTTPS for a domain. It follows redirects, inspects the final HTTPS response, parses max-age, includeSubDomains, and preload directives, and explains whether the policy is strong enough for production or preload planning.
- Follows redirect hops and evaluates the final HTTPS response.
- Parses Strict-Transport-Security max-age, includeSubDomains, and preload directives.
- Flags missing headers, invalid or short max-age values, missing subdomain coverage, missing preload directives, loops, and HTTPS downgrade risk.
How to use HSTS Checker
Enter a URL, run the check, and review the final response plus redirect chain. Start with whether the HSTS header exists, then check max-age, includeSubDomains, preload, and any HTTPS downgrade or redirect loop warnings before changing server or CDN headers.
When this tool is useful
- Check production pages before security reviews, HTTPS migrations, or CDN header changes.
- Validate max-age and includeSubDomains before considering HSTS preload submission.
- Audit transport security alongside SSL Certificate Checker, CAA Record Checker, and HTTP Header Checker.
Practical tips
- Start with a shorter max-age during rollout, then increase it after every important hostname is verified.
- Do not add includeSubDomains until all subdomains support HTTPS reliably.
- Only add preload when the domain meets preload requirements and the team accepts the long-term commitment.
Examples you can test
These examples show the kind of real input and reviewed output this tool is designed to support. Use them as a starting point before pasting your own production content, then compare the output with the destination system that will use the result. The goal is not only to produce a value, but to make the input assumptions, output format, and review step clear enough that the result can be trusted in a real workflow.
Check production HTTPS
Example input
https://example.com
Expected output
HSTS header, max-age, includeSubDomains, preload, and redirect chain
Useful before security reviews or CDN header changes.
Review preload readiness
Example input
https://www.example.com
Expected output
max-age threshold and preload directive warnings
Preload should only be considered after HTTPS is stable across the domain.
Validation checklist
Run through these checks before copying the result into a CMS, codebase, spreadsheet, campaign, support ticket, or production document. Small formatting differences, unit assumptions, hidden whitespace, and platform-specific rules are common sources of mistakes in quick browser tools, so the final review should happen in the same context where the output will be used.
- Confirm the final response is HTTPS.
- Add Strict-Transport-Security on the final HTTPS response.
- Use a production max-age only after rollout testing.
- Add includeSubDomains only when every subdomain is HTTPS-ready.
- Treat preload as a long-term commitment, not a default setting.
Why people use this tool
A site can have a valid TLS certificate but still be vulnerable to first-visit downgrade risk if HSTS is missing. At the same time, enabling a strict policy too early can break subdomains, so a focused checker helps teams stage HTTPS hardening with evidence instead of guesswork.
Related search intents
hsts header checker, hsts checker, strict transport security checker, hsts preload checker, https security header checker.