Skip to content
frabs.
All tools

/hsts-preload-checker

HSTS Preload Checker

Check whether a site meets the requirements for the HSTS preload list.

Try:

About HSTS Preload Checker

HSTS Preload Checker reads a site's Strict-Transport-Security header and checks it against the specific requirements the HSTS preload list expects: a max-age of at least one year, the includeSubDomains directive, and the preload directive itself.

Use this before submitting a domain to the preload list to catch a missing directive in advance, since the submission form itself will reject a domain that does not already meet these requirements.

Being eligible here does not mean a domain is already on the list, only that its header currently satisfies the technical requirements to apply. Submission and actual inclusion happen separately, through the preload list's own site.

Tutorials

HTTPS and TLS, What the Padlock Is Actually Telling YouWhat encryption in transit protects against, what it does not, and why a valid certificate and a security header check both matter.6 min readContent Security Policy ExplainedWhat a CSP header actually restricts, why it matters even on a site with no obvious vulnerabilities, and how to read one without getting lost in the syntax.6 min readHSTS Explained: What It Protects and What It Does NotWhy telling a browser to always use HTTPS closes a gap a valid certificate alone leaves open, and what to check before turning it on.5 min read

Related Tools