HSTS Checker
HSTS tells browsers to use only HTTPS for a site, even when someone types http. The tool reads the header and explains its settings.
Checked by our server, free and without an account
Loading the tool …
What the tool looks at
- Presence of the Strict-Transport-Security header.
- The max-age value, includeSubDomains and preload.
How it works
- Enter the address. Only public web addresses on the standard ports are accepted.
- Our server fetches what the check needs once, with its own honest bot name, and evaluates it.
- You get the evaluated values with a short explanation. Nothing from the page is stored.
More Security tools
All tools- SSL Certificate CheckerCheck the SSL/TLS certificate of a domain – issuer, validity, expiry date and the names it covers.
- Content Security Policy CheckerCheck the Content Security Policy of a page – is the header set and which sources does it allow?
- Referrer Policy CheckerCheck the Referrer-Policy of a page – how much of its address is passed on when visitors follow a link.
- Server Signature CheckerCheck whether a server reveals its software and version in the Server header – useful information for attackers.
- Mixed Content CheckerFind resources loaded over plain HTTP on an HTTPS page – browsers block or flag them.
- Unsafe Forms CheckerFind forms on a page that send data over plain HTTP – passwords and personal data must travel encrypted.
- Safe URL CheckerCheck whether a URL is listed for malware, phishing or unwanted software by Google Web Risk.
The whole page in one audit
One audit runs more than 50 tests, rates them by severity and turns them into a score. Websites are re-checked on a schedule.