Security Tools

HSTS Checker

Check whether a site tells browsers to always use HTTPS with the HSTS header.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

HSTS Enabled

github.com

Strict-Transport-Security

max-age=31536000; includeSubdomains; preload

Last checked: 48 seconds ago Cached

Download JSON Download PDF

100/100

Result Summary

Passed

Responded with status 200

HSTS header present

Enter a domain to see whether it sends Strict-Transport-Security and how its max-age, includeSubDomains and preload options are set.

What is HSTS?

HSTS (HTTP Strict Transport Security) is a response header - Strict-Transport-Security - that tells browsers to use only HTTPS for your domain for a set time (max-age). After the first visit the browser upgrades every request itself, which blocks downgrade and cookie-hijacking attacks.

How to check whether a site uses HSTS

Enter the domain in the box above.
Click Check HSTS.
Check the max-age (one year, 31536000 seconds, is common) and whether includeSubDomains is set.
Only enable includeSubDomains or preload once every subdomain works over HTTPS.

Related checks

HSTS needs a working HTTP to HTTPS redirect - verify it with the HTTPS Redirect Checker.
For all security headers at once, use the Security Headers Checker.

JustChecker monitors your security headers continuously.

Frequently Asked Questions

After one visit, the browser refuses to load the site over plain HTTP for the max-age period, even if someone types http:// or an attacker tries to downgrade the connection.

Yes, if any subdomain still needs plain HTTP: browsers will refuse to load it. Start with a short max-age such as 300 seconds, check everything works, then raise it to a year.

A list built into browsers of sites that must always use HTTPS, even on the very first visit. It needs max-age of at least a year, includeSubDomains and preload - and is hard to undo, so only apply when sure.

Share this tool:

Need a website for your business? Only $599