HSTS Test
The HSTS Test verifies that any URL serves a Strict-Transport-Security response header, which tells browsers to use HTTPS exclusively for the domain for a configurable period. HSTS protects against TLS downgrade attacks, accidental HTTP redirects, and SSL-stripping man-in-the-middle attacks. Once HSTS is set, even typing http:// in the address bar transparently uses HTTPS. The header is one line, free, and a baseline modern security control.
What This Tool Checks
- Strict-Transport-Security response header present
- max-age value (recommended: 31536000 = 1 year)
- includeSubDomains directive
- preload directive (for HSTS Preload List submission)
- HTTPS enforcement on first visit (preload status)
Why It Matters for SEO
Without HSTS, the very first HTTP request to your domain (typed URL, old bookmark, link from a non-HTTPS page) can be intercepted and downgraded by an attacker on the network. HSTS pins browsers to HTTPS for a long max-age, eliminating this window. Adding the domain to the HSTS Preload List closes the first-visit window entirely. The header is a one-line config change with no downside once HTTPS is correctly configured.
How to Fix It
Add Strict-Transport-Security: max-age=31536000; includeSubDomains to every HTTPS response. Verify HTTPS works on every subdomain before enabling includeSubDomains. After running for a few weeks with no issues, add ; preload and submit the domain to hstspreload.org for browser-bundled enforcement.
How It Works
We fetch the URL over HTTPS and inspect the Strict-Transport-Security response header. We also check the public HSTS Preload List to see whether the domain is preloaded into Chrome, Firefox and Safari for HTTPS enforcement on the first visit.
Common Mistakes to Avoid
- No HSTS header set
- Short max-age (hours instead of months)
- includeSubDomains set without subdomain HTTPS coverage (breaks subdomains)
- preload set without actually submitting to the preload list
- Adding HSTS before HTTPS is fully working (locks users into a broken state)
Quick Checklist
- HSTS header present on every HTTPS response
- max-age at least 31536000 (1 year)
- includeSubDomains set if all subdomains use HTTPS
- Domain submitted to HSTS Preload List
- HTTPS verified working before HSTS deployed