HSTS Preload Checker

About HSTS preload checker

HSTS preloading bakes your domain into browsers so that even the first visit is forced onto HTTPS. This tool probes your domain over both http and https and tests it against the published submission criteria, showing which requirements pass and which fail. Check it before submitting, because removal from the list is slow.

How to use it

1. Enter the bare domain, such as example.com, in the Domain field.
2. Select Check Eligibility. The domain is sent to our server, which makes one http and one https request.
3. Read the headline and the count of requirements passed.
4. Inspect Observed header for the Strict-Transport-Security value, max-age and directive flags.
5. Fix each failing item in the Requirements list, then check again.

Almost eligible

Strict-Transport-Security: max-age=31536000; includeSubDomains, with http redirecting to https.

Not yet eligible. HTTPS, redirect, header present, max-age and includeSubDomains all pass, but the preload directive is Absent and fails. Adding preload to the header makes every check pass.

When to use it

• Confirming a header change is correct before filing a preload submission.
• Finding out why an earlier submission was rejected.
• Auditing which company domains are missing the one-year max-age or includeSubDomains.
• Verifying that the plain http version of a domain redirects to https on its very first hop.

Questions about HSTS preload checker

What does this check require?

HTTPS on the apex domain, a first-hop redirect from http to https, a Strict-Transport-Security header with max-age of at least 31536000 seconds, includeSubDomains and preload. A malformed header adds one more failing check.

Can it tell me if my domain is already on the list?

No. It checks eligibility only, because it does not bundle the browser preload list. Use the official preload submission site for live status.

Why does the redirect requirement matter?

The list expects port 80 to redirect straight to the https version of the same host. A redirect to a different host first would fail, even if it eventually reaches HTTPS.

What should I be careful about before preloading?

Preloading applies to every subdomain and is hard to reverse. Make sure all subdomains, including internal ones, can serve valid HTTPS for at least a year first.

What limits apply to the input?

It must be a valid domain of up to 253 characters, and hosts resolving to private or internal addresses are refused. Each probe times out after eight seconds.

Related tools

• Security headers checkerFetch a URL and grade its HTTP security headers from A+ to F.
• Mixed content checkerFind insecure http:// sub-resources loaded by an HTTPS page.
• Password Strength CheckerCheck the strength of a password
• Safe URL CheckerCheck if a URL is safe to visit
• Meta Tags CheckerCheck meta tags on a webpage
• File MIME Type CheckerCheck the MIME type of a file