Built and fact-checked by the DocNectar team — see our editorial standards
Key Features
Instant Calculation
Get accurate results in real time with our optimized algorithm.
Mobile Friendly
Fully responsive design. Works on all devices & screen sizes.
Privacy Focused
Your data stays on your device. We don't store any inputs.
100% Free
No hidden costs. This tool is completely free forever.
HTTP Strict Transport Security (HSTS) tells browsers to only ever connect to a site over HTTPS for a set duration, protecting against protocol-downgrade and cookie-hijacking attacks on the first plain-HTTP request. This tool checks whether a site sends the header and parses its settings.
How it works
The tool fetches the page live and inspects the response for a Strict-Transport-Security header, parsing out its max-age (converted to days), whether includeSubDomains is set, and whether the preload flag is present.
- Enter website URL.
- Click Calculate to see your results.
Examples
A well-configured HSTS header
max-age=31536000; includeSubDomains; preload sets a full year of enforced HTTPS, extends that enforcement to every subdomain, and opts into browser preload lists that enforce HTTPS even before the first visit.
Who should use it
- Verifying HSTS is correctly configured after enabling HTTPS.
- Auditing a site's security headers as part of a broader security review.
Industry applications
- IT security and compliance audits
- Web hosting/DevOps configuration verification
Advantages
- Parses out max-age, includeSubDomains, and preload individually, not just header presence.
- Same SSRF-guarded live-fetch approach used by this site's other website-scanning tools.
Limitations
- Checks only the exact URL given — doesn't follow redirects to see if HSTS is set further down the chain.
Common mistakes to avoid
- Testing a URL that redirects, since this tool checks the header on the initial response only, not a final redirect destination.
- Setting includeSubDomains without first confirming every subdomain actually supports HTTPS — that flag applies HSTS enforcement to all of them, not just the one being tested.
Best practices
- Set a long max-age (a year is common) once you're confident HTTPS is fully and permanently supported.
- Only add includeSubDomains once every subdomain is confirmed to serve valid HTTPS — it applies broadly and can't be selectively scoped.
Tips
- Pair with the TLS Version Support Checker and Mixed Content Finder for a fuller HTTPS security picture.