HSTS checker

What HSTS actually does

Once a browser has seen this header from a domain, it will not attempt a plain-HTTP connection to that domain again until the max-age expires - it rewrites the request to HTTPS internally, before any network request is made, closing the window where a redirect-based approach can still be intercepted on that first HTTP request.

The three parts

• max-age - how long, in seconds, the browser should remember this. A short max-age barely protects anyone; a common real-world value is one year (31536000 seconds).
• includeSubDomains - without it, HSTS applies only to the exact domain, not www. or any other subdomain.
• preload - a signal the site wants to be included in a browser-shipped list, so protection applies from a user's very first visit rather than only after they have seen the header once. The header alone does not enroll a site - see the preload checker for actual list membership.

Why it must only be sent over HTTPS

A browser only honors this header when it arrives over a connection it has already verified as HTTPS - sending it over plain HTTP would let anyone intercepting that connection strip it out, which is exactly the attack HSTS exists to prevent.

Related tools

See HTTPS checker and HTTPS redirect checker for whether HTTP visitors reach HTTPS in the first place.