HSTS (HTTP Strict Transport Security) is a response header that tells the browser to only ever reach your site over HTTPS — for a duration you set with max-age. Once a browser has seen it, it upgrades every future request to HTTPS before anything leaves the device, which closes the small plaintext gap an attacker can exploit on the first request. Test any domain below, then add the header if it's missing.
HSTS test
Passive read of the homepage response headers · result not stored, not indexed.
What the test reports
The test reads the homepage response your server already returns and reports the state of its Strict-Transport-Security header: whether it is present, its max-age (how long the browser will force HTTPS), and whether includeSubDomains and preload are set. It performs no intrusive testing — it is the same read any browser does on a normal visit, and the result stays in your browser.
What HSTS actually does
Without HSTS, the very first time someone types example.com the browser makes a plaintext HTTP request before your redirect sends it to HTTPS. On a hostile network that first hop can be intercepted and downgraded (the classic SSL-strip attack). HSTS removes the hop: after the browser has seen the header once, it rewrites http:// to https:// internally for the whole max-age window, so there is no plaintext request to intercept.
max-age— seconds the rule is remembered. Use a long value in production;63072000(two years) is the common recommendation.includeSubDomains— applies the same HTTPS-only rule to every subdomain. Only add it once every subdomain genuinely serves HTTPS.preload— opts the domain into the browser preload list so HTTPS is forced even on the very first visit. This is a one-way commitment; see the deep dive.
For the site owner (plain English)
If the test shows HSTS is missing or the max-age is very short, your site is still relying on an HTTP-to-HTTPS redirect that can be attacked on untrusted networks. It is a one-line fix your host or developer can apply in minutes, and it has no visible effect on visitors — the site simply refuses to load over plain HTTP. Ask whoever manages your server or CDN to add the header below, then re-run the test to confirm it took effect.
How to add HSTS
Send the header on HTTPS responses. Start with a shorter max-age while you confirm nothing breaks, then raise it:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload# nginx (inside the HTTPS server block)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
# Apache (mod_headers)
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"// Next.js — next.config.mjs
async headers() {
return [{
source: "/:path*",
headers: [{
key: "Strict-Transport-Security",
value: "max-age=63072000; includeSubDomains; preload",
}],
}];
}On Cloudflare you can enable HSTS under SSL/TLS → Edge Certificates → HSTS, which sets the header at the edge with the same options.
includeSubDomains or preload until every subdomain serves valid HTTPS: preload in particular is hard to reverse quickly.For the preload list, the one-way commitment, and how to submit or remove a domain, read the HSTS preload deep dive. HSTS is one of several response headers worth setting — see the complete security headers guide and pair it with a Content-Security-Policy. To check every header at once, run the security headers checker.