HSTS Checker: Is Strict-Transport-Security Set Right?
HSTS (HTTP Strict Transport Security) is a response header that tells browsers to use HTTPS for your site for a set time, even if someone types http://. Enter your domain to check the header, its max-age, includeSubDomains and preload settings, and whether HTTP redirects to HTTPS — the conditions for the preload list.
We request both the https:// and http:// versions of your domain and read the Strict-Transport-Security header your server returns. Free, no signup. Updated Oct 24, 2026 by the AEOeye team.
HSTS Header: max-age, includeSubDomains and Preload
The header has one required part and two optional ones (MDN):
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
- max-age — how many seconds browsers should remember to use HTTPS. One year (31536000) is the common target.
- includeSubDomains — applies the rule to every subdomain. Only add it when all of them serve HTTPS.
- preload — signals that you want to be on browsers' built-in HSTS list.
Browsers only honor the header when it's sent over HTTPS.
Why does HSTS matter if I already redirect to HTTPS?
Because the redirect itself happens over plain HTTP. On the first visit, an on-path attacker can intercept that redirect and keep the browser on HTTP, a weakness hstspreload.org describes as a protocol downgrade. After one HTTPS visit, HSTS makes the browser skip HTTP entirely; preloading removes even that first-visit gap.
What does it take to get on the preload list?
Four conditions, per hstspreload.org: a valid certificate, a redirect from HTTP to HTTPS on the same host, HTTPS on all subdomains, and an HSTS header on the base domain with max-age of at least 31536000, includeSubDomains and the preload directive.
Preloading is hard to undo — removal takes a long time to reach users — so ramp up max-age in stages first, as the site recommends.
How do real sites set HSTS?
Most send it; few are preload-ready. In our October 2026 analysis of 315 big-brand homepages (dataset), 84.1% sent an HSTS header, 68.3% with a max-age of at least a year. But only 45.1% included subdomains, 32.7% carried the preload directive and 26% met all three header conditions for preloading.
How do I read the result?
Fail means the header is missing or max-age is very short; warn means it works but isn't preload-eligible; pass means it's set correctly. The recommended header at the bottom is ready to paste. Check the rest of your headers with the security headers checker, and make sure your HTTP-to-HTTPS redirect is a single hop with the redirect checker.
One page checked. What about the rest of your site?
The free SEO audit crawls your site and scores ~90 checks across 7 areas — with the evidence and the fix for each problem.
FAQ
What is HSTS?
+
HTTP Strict Transport Security: a response header that makes browsers connect to your site only over HTTPS for the time set in max-age, protecting visitors from downgrade attacks.
What max-age should I use for HSTS?
+
Start small, for example 300 seconds, to test, then increase in stages to one year (31536000 seconds). One year is the minimum for the HSTS preload list.
Can HSTS break my site?
+
Yes, if any part of the site or a subdomain still needs plain HTTP. With includeSubDomains, every subdomain must serve HTTPS, so audit them before adding it.
Sources
Related free tools
Security Headers Checker
Free security headers checker: scan a URL for HSTS, CSP, X-Frame-Options, X-Content-Type-Options and more, graded A–F with copy-paste fixes.
Redirect Checker
Free redirect checker: paste a URL to see every hop, status code (301/302/307/308), timing and loops — and whether the chain hurts SEO. No signup.
HTTP Header Checker
Free HTTP header checker: see every response header for a URL, with SEO-critical ones flagged — X-Robots-Tag, canonical Link, cache-control, HSTS.
Mobile-Friendly Test
Google retired its Mobile-Friendly Test in Dec 2023. Test any URL here: real mobile screenshot, viewport and font checks, and a clear pass or fail.