HSTS Checker – Check Strict-Transport-Security Header

Check whether a website sends an HTTP Strict Transport Security (HSTS) header and see how its HTTPS security policy is configured.

Our free HSTS Checker examines a website’s HTTPS response and displays its Strict-Transport-Security header, max-age value, includeSubDomains setting, and preload directive. It also identifies missing or invalid HSTS headers and reports connection or redirect issues.

Enter a public website domain below to check its HSTS configuration.

Website security tool

Check a website's HSTS header

Enter a public domain or website URL. We check its HTTPS response for the Strict-Transport-Security header.

How this check works: Your input is sent to this website's WordPress server, which requests the public site's HTTPS response. The target website may see this server's IP address. Results may be cached for one minute. This is a header check, not a full TLS audit or preload-list lookup.

How to Check a Website’s HSTS Header

You can check a website’s HSTS configuration in three steps:

Enter the domain: Type a public domain such as example.com or its complete website URL.
Click Check HSTS: The tool requests the domain’s HTTPS homepage and examines its response headers.
Review the results: Check whether HSTS is present, how long the policy lasts, and which additional directives are configured.

The tool checks the HTTPS response at the domain’s root address. It does not follow redirects automatically. If a website redirects to another hostname, check that hostname separately.

What Is HSTS?

HTTP Strict Transport Security (HSTS) is a web security mechanism that instructs browsers to communicate with a website using HTTPS instead of unencrypted HTTP.

When a browser receives a valid HSTS header over a secure connection, it remembers the website’s HTTPS-only policy for a specified period.

During that period, the browser automatically upgrades HTTP requests for the covered hostname to HTTPS. It also prevents users from bypassing certain certificate errors for that hostname.

For example, if a browser has already learned an HSTS policy for a website, an attempt to visit its HTTP address will be upgraded to HTTPS before the connection is made.

HSTS helps protect against protocol downgrade attacks, but it does not replace a valid SSL/TLS certificate or other website security measures.

Understanding Your HSTS Checker Results

The checker examines the observed response and provides an explanation of its findings.

Result	What it means
HSTS policy present	A syntactically valid HSTS header with a positive `max-age` value was detected.
HSTS header not found	The checked HTTPS response did not contain the HSTS header.
HSTS disabled	The response contained `max-age=0`, which instructs browsers to remove the cached policy for that hostname.
HSTS header needs review	The header contains missing, duplicate, or incorrectly formatted directives.
Request failed	The tool could not complete the HTTPS request, potentially because of a connection, certificate, DNS, or server issue.

A missing header does not necessarily mean a browser has no existing HSTS protection. The browser may have previously cached a policy or may already include the domain in its preload list.

Likewise, an active HSTS header does not establish that the entire website is secure.

What Do HSTS Header Directives Mean?

An HSTS header contains settings that determine how browsers enforce the website’s HTTPS policy.

1. max-age

The max-age directive tells browsers how long to remember the HSTS policy. Its value is measured in seconds.

For example:

max-age=31536000

This represents 365 days.

A longer duration keeps the policy in effect for longer, but it also increases the consequences of an incorrect HTTPS configuration.

Setting max-age=0 tells browsers receiving the valid HTTPS header to remove the stored HSTS policy for that hostname.

2. includeSubDomains

The optional includeSubDomains directive extends the HSTS policy to subdomains of the hostname that sends it.

For example, an HSTS policy on example.com with includeSubDomains also covers blog.example.com and shop.example.com.

Before enabling this directive, website administrators should verify that all affected subdomains support HTTPS correctly. This includes internal services that may not be publicly accessible.

3. preload

The preload directive indicates an intention to have the domain included in browser HSTS preload lists.

Preloading can allow browsers to enforce HTTPS before a user has visited a website for the first time.

However, the presence of the preload directive does not prove that a domain is preloaded.

The HSTS Checker reports whether the directive is present. It does not verify actual preload-list membership.

To review preload eligibility or inclusion status, visit hstspreload.org.

Preloading is a long-term commitment. It should not be enabled casually because removing a preloaded domain from browsers can take considerable time.

Example of an HSTS Header

A website may return the following HTTPS response header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

This example means:

The browser should remember the HTTPS-only policy for 365 days.
The policy covers the issuing hostname and its subdomains.
The header does not contain the optional preload directive.

This is an illustrative configuration, not a universal recommendation. The appropriate HSTS policy depends on the website’s HTTPS readiness and subdomain requirements.

How to Fix Common HSTS Problems

HSTS Header Is Missing

If the checker cannot find an HSTS header, first confirm that your website works correctly over HTTPS.

Website administrators can then configure the header through their web server, hosting control panel, content delivery network (CDN), or another component responsible for HTTP response headers.

Check your hosting provider’s instructions before changing server settings. Start with a short policy duration and extend it after verifying that the configuration works.

HSTS Is Disabled

A header containing max-age=0 disables the stored HSTS policy for the hostname when received over a valid HTTPS connection.

Check whether this was intentional. If the website requires HSTS, review the server or CDN configuration before restoring a positive max-age value.

HSTS Header Has Invalid Syntax

Check for missing max-age values, repeated directives, incorrect formatting, or values that do not follow the HSTS specification.

For example, max-age must contain a valid non-negative integer representing seconds.

Correct the configuration and run another test.

HTTPS Connection Failed

A failed HTTPS request can result from an expired or invalid certificate, DNS problems, server availability, or network restrictions.

Check whether the website loads over HTTPS in a browser and whether its certificate is valid. If necessary, contact your hosting provider.

An unsuccessful check is not proof that HSTS is disabled.

Website Redirects to Another Domain

Some websites redirect visitors from the root domain to a www hostname, or from one hostname to another.

The checker reports an HTTPS redirect but does not follow it. Run a separate check on the destination hostname to inspect its response header.

HSTS vs. HTTPS: What’s the Difference?

HTTPS encrypts communication between a browser and a website using TLS.

HSTS adds a browser-enforced rule requiring future connections to the covered hostname to use HTTPS.

A website can use HTTPS without enabling HSTS. Having a valid HTTPS certificate does not automatically mean its HSTS header is configured.

Both serve different purposes and should be understood separately.

Important Limitations of This HSTS Checker

This tool is designed for a focused HTTP response-header check. It is not a complete website security scanner.

The checker:

Requests the public hostname’s HTTPS homepage.
Examines the Strict-Transport-Security header on that response.
Reports relevant directives, syntax issues, HTTPS response status, and redirects.
Does not scan every webpage or subdomain.
Does not examine a visitor’s browser HSTS cache.
Does not verify browser preload-list inclusion.
Does not perform a complete SSL/TLS configuration audit.

Private network addresses, IP literals, and custom ports are not supported.

Privacy note: The domain entered is sent to NetTools Pakistan’s WordPress server for checking. The server contacts the target website, which may see its IP address. Results may be cached for up to one minute. Routine hosting and server logs may also apply.

Check Your Website’s HSTS Configuration

A properly configured HSTS policy helps browsers enforce HTTPS connections, but its benefits depend on correct deployment.

Use the HSTS Checker to inspect the observed header, identify potential configuration problems, and verify changes after updating your website’s settings.

For additional technical guidance, consult the following references:

NetTools Pakistan is an independent internet connectivity and diagnostic tools website. This checker is not affiliated with PTCL, PTA, or any internet service provider.