Your files stay on your device

# HSTS checker

Read a domain's Strict-Transport-Security header and report max-age, includeSubDomains and preload with what each part means.

Press the button to read the header
Nothing leaves this page until you do. The check reads one Strict-Transport-Security header and explains each part of it against the common minimums.

The header shown is what one GET from this project's proxy received at check time. Browsers only honor it on HTTPS responses, so the request always goes out over https. The preload directive is consent, not membership: whether the domain actually rides in the list browsers ship is a separate question, and the HSTS Preload Checker on this site answers that one. A CDN or reverse proxy in front of the origin may set or strip the header itself, so what you see here is what that edge answered, not necessarily what the origin is configured to send.
Options

## More network tools

- [HTTP header parser](/web/headers)
- [HTTP timing probe](/network/http-timing)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/hsts-checker
Markdown version: https://nutter.tools/network/hsts-checker.md
Plain-text version: https://nutter.tools/network/hsts-checker.txt
Agent index: https://nutter.tools/llms.txt