HSTS checker: does this site tell browsers to stay on HTTPS?

What HSTS does

HTTP Strict Transport Security is a response header. Once a browser has seen it on an HTTPS page, it connects to that host over HTTPS only until the stated lifetime runs out, even if the visitor types http:// or follows an old link. That closes the window in which a first request over plain HTTP could be intercepted or redirected.

The lifetime is the max-age value, in seconds. The check converts it to days: max-age=31536000 is 365 days.

What the check reads, and what it does not

• It makes one GET request to the HTTPS homepage of the host you enter and reads the header from that response. Redirects are not followed, so check www and the bare domain separately if visitors can land on either.
• It shows the lifetime and flags anything under 31,536,000 seconds (one year). A header that cannot be parsed is shown as it is, not called weak.
• It does not evaluate includeSubDomains or preload. Those are choices you make; read them in the raw header before you submit a domain to the browser preload list.
• A header sent over plain HTTP is ignored by browsers, so a site that only redirects from HTTP to HTTPS still needs the header on the HTTPS response.

How to set it

1. Make sure every host you intend to cover answers over HTTPS with a valid certificate. includeSubDomains applies the rule to all subdomains, including ones you forgot.
2. Start with a short lifetime such as one day (max-age=86400) and load the site and its subdomains. Browsers remember the rule, so a mistake lasts as long as the lifetime you sent.
3. Raise it to one year once nothing breaks. In nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;. In Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains".
4. On a CDN or hosting platform, use its HSTS setting if it has one, then run the check again to confirm the header reaches the visitor.

Common questions

What is an HSTS checker?

It requests a website over HTTPS and reads the Strict-Transport-Security response header. A site that sends it tells browsers to use HTTPS only for the stated time, so a later visit cannot be downgraded to HTTP.

What HSTS lifetime should I use?

One year (max-age=31536000) is the usual target and the minimum for the browser preload list. Glarion flags anything shorter. Start with a short value while you test, then raise it.

Does the free check read includeSubDomains and preload?

No. The free result shows whether the header is present and its lifetime in days. includeSubDomains and preload are directives you set yourself; check them on the response before you submit a domain to the preload list.

Why does the check say HSTS is missing when my site redirects to HTTPS?

A redirect is not HSTS. The header has to be sent on the HTTPS response itself, and browsers ignore it when it arrives over plain HTTP. The check does not follow redirects, so test the exact host visitors land on.

Read next

• Security headers check The six response headers and what a missing one allows.
• SSL certificate checker Expiry date and days left, read over a live TLS handshake.
• What the free check includes Certificate, headers, email policies, cookie flags and public files.
• SPF and DMARC checkerThe published email policy, read from public DNS.

Keeping headers right on client sites

A theme update or a new CDN can drop a header that took a day to tune. A paid plan verifies each domain once, rechecks it on a schedule, emails you when results change and puts the findings in a branded report for the client.