HSTS Checker
Ensure your site strictly enforces HTTPS connections.
HSTS Checker
Verify if a website has HTTP Strict Transport Security (HSTS) properly configured to enforce secure connections and prevent downgrade attacks.
Enter a domain or URL above to instantly check its Strict Transport Security configuration.
What is HSTS?
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.
It allows web servers to declare that web browsers should automatically interact with it using only HTTPS connections, and never via the insecure HTTP protocol.
HSTS Directives
max-age: The time, in seconds, that the browser should remember that a site is only to be accessed using HTTPS.includeSubDomains: If this optional parameter is specified, this rule applies to all of the site's subdomains as well.preload: An optional, non-standard directive indicating that the site owner wants their domain added to a hardcoded list of HSTS domains baked into major web browsers.
Related Guides
Deepen your understanding with our expert articles.