X-RAY // WEB // HSTS

HSTS
CHECK.

Read the Strict-Transport-Security header (max-age, includeSubDomains, preload) and see whether the domain is on the browser preload list.

Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.

HSTS

WAITING

Enter a domain above to run this check.

01 // WHAT THE CHECK VERIFIES

What the check verifies

Reads the Strict-Transport-Security header and checks whether the domain is on the browser preload list.

02 // WHY IT MATTERS

Why it matters

HSTS makes the browser use HTTPS only for a period, even if someone tries to downgrade the connection. Preload protects the very first visit too.

03 // HOW TO READ THE RESULT

What each result means

OK: HSTS on, with a max-age of at least 180 days.
WARNING: No HSTS header, max-age=0 or a max-age under 180 days.
FAIL: The navigation ends on HTTP, and HSTS does not apply.

ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.

04 // HOW TO FIX

How to fix

Send the header on every HTTPS response. Only use includeSubDomains if every subdomain has HTTPS. Preload (hstspreload.org) requires a max-age of 1 year, includeSubDomains, the preload directive and HTTP redirecting to HTTPS on the same host.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Would rather have someone else do it? Bit Happens can fix this →

05 // CONTINUE

More checks in Website and HTTPS

Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →