Article

HSTS Test: Check Your Strict-Transport-Security Header

HSTS (Strict-Transport-Security) tells browsers to reach your site over HTTPS only, closing the plaintext gap on the first request. Test any domain for its HSTS state, then add max-age=63072000; includeSubDomains if it's missing.

By Paul Rudenko, Security ResearcherUpdated Jul 1, 20266 min read

HSTS (HTTP Strict Transport Security) is a response header that tells the browser to only ever reach your site over HTTPS — for a duration you set with max-age. Once a browser has seen it, it upgrades every future request to HTTPS before anything leaves the device, which closes the small plaintext gap an attacker can exploit on the first request. Test any domain below, then add the header if it's missing.

HSTS test

Passive read of the homepage response headers · result not stored, not indexed.

What the test reports

The test reads the homepage response your server already returns and reports the state of its Strict-Transport-Security header: whether it is present, its max-age (how long the browser will force HTTPS), and whether includeSubDomains and preload are set. It performs no intrusive testing — it is the same read any browser does on a normal visit, and the result stays in your browser.

What HSTS actually does

Without HSTS, the very first time someone types example.com the browser makes a plaintext HTTP request before your redirect sends it to HTTPS. On a hostile network that first hop can be intercepted and downgraded (the classic SSL-strip attack). HSTS removes the hop: after the browser has seen the header once, it rewrites http:// to https:// internally for the whole max-age window, so there is no plaintext request to intercept.

  • max-age — seconds the rule is remembered. Use a long value in production;63072000 (two years) is the common recommendation.
  • includeSubDomains — applies the same HTTPS-only rule to every subdomain. Only add it once every subdomain genuinely serves HTTPS.
  • preload — opts the domain into the browser preload list so HTTPS is forced even on the very first visit. This is a one-way commitment; see the deep dive.

For the site owner (plain English)

If the test shows HSTS is missing or the max-age is very short, your site is still relying on an HTTP-to-HTTPS redirect that can be attacked on untrusted networks. It is a one-line fix your host or developer can apply in minutes, and it has no visible effect on visitors — the site simply refuses to load over plain HTTP. Ask whoever manages your server or CDN to add the header below, then re-run the test to confirm it took effect.

How to add HSTS

Send the header on HTTPS responses. Start with a shorter max-age while you confirm nothing breaks, then raise it:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
# nginx (inside the HTTPS server block)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# Apache (mod_headers)
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
// Next.js — next.config.mjs
async headers() {
  return [{
    source: "/:path*",
    headers: [{
      key: "Strict-Transport-Security",
      value: "max-age=63072000; includeSubDomains; preload",
    }],
  }];
}

On Cloudflare you can enable HSTS under SSL/TLS → Edge Certificates → HSTS, which sets the header at the edge with the same options.

Common gotcha: HSTS only takes effect over HTTPS — a browser ignores the header if it arrives over plain HTTP, so you still need your HTTP→HTTPS redirect in front of it. And don't add includeSubDomains or preload until every subdomain serves valid HTTPS: preload in particular is hard to reverse quickly.

For the preload list, the one-way commitment, and how to submit or remove a domain, read the HSTS preload deep dive. HSTS is one of several response headers worth setting — see the complete security headers guide and pair it with a Content-Security-Policy. To check every header at once, run the security headers checker.

Frequently asked questions

What is an HSTS test?

An HSTS test reads the Strict-Transport-Security response header a website returns and reports whether HSTS is enabled and how it is configured. It tells you if the header is present at all, the max-age value (how many seconds the browser will force HTTPS for), and whether the includeSubDomains and preload options are set. This tool runs that check passively — it reads the homepage response the same way any browser does, sends nothing intrusive, and keeps the result in your browser. If the header is missing or the max-age is very short, the page shows the exact header value to add.

What is a good HSTS max-age value?

For production, a long max-age is recommended — 63072000 seconds (two years) is the widely used value and is required if you ever want to join the preload list. The max-age is how long a browser will remember to force HTTPS after it last saw the header, so a short value (a few minutes or hours) gives little protection because the rule expires quickly. A common rollout is to start with a small max-age while you confirm every page and subdomain works over HTTPS, then raise it to two years once you are confident nothing is served over plain HTTP.

Does HSTS replace the HTTP to HTTPS redirect?

No — you need both. A browser only honours the Strict-Transport-Security header when it is delivered over HTTPS, and it ignores the header entirely on a plain HTTP response. So the very first time a browser contacts your domain over HTTP, your server still has to redirect it to HTTPS; only after that first secure response does HSTS take over and upgrade every future request automatically. Keep your HTTP→HTTPS redirect in place and add HSTS on top of it. The preload list is the only way to also protect that very first request, before the browser has ever seen your header.

Should I add includeSubDomains?

Add includeSubDomains only once every subdomain of your site serves valid HTTPS. The directive extends the HTTPS-only rule to all subdomains, which is exactly what you want for security — but if a subdomain (an old blog, a staging host, an internal tool) is still reachable over HTTP or has no certificate, it will stop loading for anyone whose browser has seen the header. Audit your subdomains first, move them to HTTPS, then add includeSubDomains. It is also a prerequisite for preload, so getting it right is the step before you consider the preload list.

Related guides

See your whole external attack surface

One page is a start. The full external scan covers TLS, headers, DNS, exposed files, open services and known-exploited CVEs across your whole domain.

See the full scan →