HSTS preload checker

Why this needs a separate check from the HSTS header itself

A domain's own Strict-Transport-Security header can include the word preload, but that alone does not mean the domain has actually been reviewed and shipped inside a browser's source code. Actual inclusion has to be looked up against the real list, which is exactly what this queries.

The statuses explained

• Preloaded - shipped in current browser builds. HTTPS is enforced for this domain from a browser's very first connection to it, ever.
• Pending - submitted and passed the automated eligibility checks, waiting to ship in a future browser release.
• Unknown - not preloaded and not submitted.
• Rejected - submitted, but did not meet the requirements (typically an HSTS header missing includeSubDomains, too short a max-age, or a subdomain not fully serving HTTPS).

Why preloading is a one-way decision worth taking seriously

Removal from the list is slow and not guaranteed - once every subdomain of a domain is expected to serve valid HTTPS unconditionally, from every browser that shipped the list, undoing that if a subdomain turns out to need plain HTTP is far harder than the original submission.

Related tools

See HSTS checker for the domain's own header first.