HSTS checker

What is HSTS checker?

HSTS checker inspects the Strict-Transport-Security response header on a webpage. HSTS tells supporting browsers to use HTTPS for the host after learning its policy. This tool helps you review the header that the tested response publishes when investigating secure transport settings.

How to use this tool

Enter the HTTPS URL and submit the checker. Read the full header value if one is returned, then review the tool's validity label. Compare results across important hostnames and routes before assuming that a policy is applied consistently throughout your website.

Understanding the results

This implementation marks a header as valid when it finds a positive max-age value. That is a narrow syntax check, not confirmation of preload status, subdomain coverage, certificate health, or a complete security policy. A header delivered over plain HTTP does not establish a browser HSTS policy. Consult the HSTS header reference when reviewing the meaning of its directives.

Frequently asked questions

Does the valid label mean my site is secure?

No. It indicates that the checker found its expected max-age pattern. Other HTTPS configuration, application behavior, and security controls need separate testing.

Should I enable subdomain coverage immediately?

Only after confirming that the affected subdomains support HTTPS as intended. A broad transport policy changes browser behavior, so use your provider's supported configuration process and verify the scope.

Continue your review

For a more complete picture, combine these findings with SSL Lookup, HTTP headers lookup, and Mixed content checker.