Network Tools
Check whether a domain sends the Strict-Transport-Security header.
Use this HSTS checker to verify whether a domain returns the Strict-Transport-Security header and inspect key values such as max-age, includeSubDomains, and preload. It is useful for HTTPS hardening, security reviews, deployment checks, and header validation.
Use this HSTS checker to verify whether a domain returns the Strict-Transport-Security header and inspect key values such as max-age, includeSubDomains, and preload. It is useful for HTTPS hardening, security reviews, deployment checks, and header validation.
Use hsts checker when you need a fast browser-based result without extra setup. It works well for quick checks, one-off tasks, and routine formatting or calculation work.
Read step-by-step usage guidance, best practices, and common mistakes.
See common questions and answers about input, output, and tool usage.
Review practical input and output examples before running the tool.
Find similar and supporting tools for adjacent actions and follow-up tasks.
Input
example.com
Output
Domain: example.com HSTS: Present Header: max-age=31536000; includeSubDomains; preload Max-Age: 31536000 Include Subdomains: Yes Preload: Yes
Shows a correctly returned HSTS header with common security directives.
Input
example.com
Output
Domain: example.com HSTS: Not present
Useful when checking whether a site still needs HSTS to be enabled.
Fix: Enter only the domain or hostname, such as example.com.
Fix: Retry with the canonical HTTPS domain and confirm the site is reachable.
Fix: Check the final secure hostname that serves the HTTPS response.
Fix: Review max-age, includeSubDomains, and preload separately in the output.
HSTS stands for HTTP Strict Transport Security. It tells browsers to use HTTPS for future requests to the site.
It checks whether the Strict-Transport-Security header is present and reads important directives such as max-age, includeSubDomains, and preload.
Enter a domain or hostname like example.com.
It helps reduce downgrade and insecure transport risks by forcing browsers to prefer HTTPS.
It means the HSTS policy also applies to subdomains, not just the main hostname.
It signals that the domain may be intended for browser preload lists, though preload status itself is a separate process.