Free HSTS Checker

Test the Strict-Transport-Security header on any public website. Inspect max-age, includeSubDomains and preload directives, then get a practical configuration review.

HSTS is only meaningful when delivered over HTTPS. DeployPass performs passive public checks only.

Checking HSTS configuration…

HSTS SCORE

—/100

REVIEW

Strict-Transport-Security review

—Header

—Max-age

—Subdomains

—Preload

Strict-Transport-Security: —

Configuration review

Understand the result

What a strong HSTS policy contains.

HSTS tells a browser to use HTTPS for future requests to a host. The header's directives control how long that rule lasts, whether it extends to subdomains, and whether the site signals an intent to join browser preload lists.

max-age

The number of seconds a browser remembers the HTTPS-only policy. A one-year value is 31536000 seconds.

max-age=31536000

includeSubDomains

Extends the policy to subdomains. Enable it only when all intended subdomains are ready for HTTPS.

includeSubDomains

preload

Signals intent to participate in browser preload programs. The directive alone does not mean the domain is actually preloaded.

preload

Preload-style header

A commonly used preload-ready form combines a long max-age with both directives.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Important

Do not enable preload casually.

HSTS can make HTTP-only subdomains unreachable. Before using includeSubDomains or pursuing preload, confirm that the root domain and every affected subdomain can remain on HTTPS. DeployPass checks the observed header; it does not claim that a domain is present in a browser preload list.

FAQ

HSTS checker FAQ

What is HSTS?

HTTP Strict Transport Security is a browser policy delivered through the Strict-Transport-Security response header. It tells supporting browsers to use HTTPS for future requests to the host.

What max-age should HSTS use?

The right rollout depends on your environment. For preload eligibility, a max-age of at least 31536000 seconds is required. Teams often begin more cautiously before committing to a long-lived policy.

Does the preload directive mean my site is preloaded?

No. The directive signals intent. Actual preload-list inclusion has additional requirements and a separate submission process.

Why is includeSubDomains risky?

It applies the HTTPS-only policy to subdomains too. A legacy or internal subdomain that cannot serve HTTPS can become inaccessible to browsers enforcing the policy.

Can I check all security headers?

Yes. Use DeployPass Security Headers Checker for CSP, HSTS, MIME sniffing, framing, Referrer-Policy, CORS and observable cookie signals.