Xerobit

HSTS Checker and Strict-Transport-Security Header Generator

Use this hsts checker to build a valid Strict-Transport-Security header by setting max-age, includeSubDomains and preload directives. You can also paste an existing header to validate its syntax and check whether it meets the requirements for HSTS preload list submission. Everything runs locally in your browser without uploading any data.

Result

Strict-Transport-Security: max-age=31536000; includeSubDomains
Status: Valid HSTS header
Max-age: 31,536,000 seconds
includeSubDomains: Yes
preload: No
Preload eligible: No (preload directive is required.)
  • Header
    Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Status
    Valid HSTS header
  • Max-age
    31,536,000 seconds
  • includeSubDomains
    Yes
  • preload
    No
  • Preload eligible
    No

    preload directive is required.

Browsers honour this header only when it arrives over HTTPS.

How to use the hsts header generator

  1. Select Build header to generate a new Strict-Transport-Security value, or Validate pasted header to act as an hsts checker for an existing string.
  2. When building, enter the max-age in seconds. A common value is 31536000 (one year).
  3. Check Include subdomains if you want the policy to apply to all subdomains of your host.
  4. Check Preload only when you intend to submit your domain to the HSTS preload list maintained by browsers.
  5. Copy the generated header into your web server configuration, or review the validation results for errors and preload eligibility.

How the Strict-Transport-Security header works

The Strict-Transport-Security response header tells browsers to only access the site over HTTPS for a specified duration. The syntax is defined in RFC 6797 and consists of a required max-age directive followed by optional includeSubDomains and preload tokens.

The max-age value is an integer representing seconds. For example, max-age=31536000 instructs the browser to remember the rule for exactly one year (365 days multiplied by 24 hours multiplied by 3600 seconds). When a user visits the site over HTTPS, the browser stores this policy and automatically upgrades any future HTTP requests to HTTPS until the timer expires.

Common max-age values

Choosing the right max-age depends on how confident you are that your site will always support HTTPS. Start with a low value during testing and increase it once you are certain everything works.

DurationSeconds
5 minutes (testing)300
1 day86400
1 week604800
1 month2592000
1 year (recommended minimum)31536000
2 years (commonly recommended)63072000

HSTS preload eligibility

The HSTS preload list is built into major browsers like Chrome, Firefox and Safari. Domains on this list are hardcoded to require HTTPS before the first connection even happens, eliminating the window where a downgrade attack could occur. To qualify, your header must meet three strict criteria:

  • The max-age must be at least 31536000 seconds (one year).
  • The includeSubDomains directive must be present.
  • The preload directive must be present.

This tool acts as an hsts checker that verifies these conditions automatically when you build or validate a header. If any condition is missing, the output explains what needs to change before you can submit your domain to hstspreload.org. These are the header requirements only: the site must also serve a valid certificate, redirect HTTP to HTTPS on the same host, and serve HTTPS on every subdomain. The tool cannot check those because it never contacts your server.

Validating an existing header

If you already have a server configured and want to verify the header it sends, switch the mode to Validate pasted header and paste the raw value (without the header name itself, or with it, as the parser handles both). The validator checks for syntax errors such as missing max-age, non-numeric values, duplicate directives or unknown tokens.

For broader server analysis, you can combine this hsts checker with a full security headers checker or an http headers checker to ensure your entire response is correctly configured. Validating the Strict-Transport-Security header in isolation helps you catch typos before they lock users out of your site.

Deployment best practices

Deploying HSTS incorrectly can make your site inaccessible if your certificate expires or you need to revert to HTTP. Follow a gradual rollout strategy:

  1. Start with a short max-age like 300 seconds and no includeSubDomains.
  2. Monitor your error logs for mixed content issues or broken subdomains.
  3. Increase the max-age step by step over several weeks.
  4. Add includeSubDomains only after confirming every subdomain serves valid HTTPS.
  5. Add preload and submit to the preload list only when you are committed to HTTPS permanently.

To remove a domain from the preload list, drop the preload token from the header and submit a removal request at hstspreload.org. Be aware that it takes months to reach users because browsers update their lists infrequently.

Worked examples

ExampleInputResult
One year with subdomainsMode: build; Max age (seconds): 31536000; Include subdomains: yes; Preload: noHeader: Strict-Transport-Security: max-age=31536000; includeSubDomains; Status: Valid HSTS header; Max-age: 31,536,000 seconds; includeSubDomains: Yes; preload: No; Preload eligible: No
Preload readyMode: build; Max age (seconds): 63072000; Include subdomains: yes; Preload: yesHeader: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload; Status: Valid HSTS header; Max-age: 63,072,000 seconds; includeSubDomains: Yes; preload: Yes; Preload eligible: Yes
Validate a headerMode: check; Max age (seconds): 31536000; Include subdomains: yes; Preload: no; Paste header to validate: max-age=31536000; includeSubDomains; preloadStatus: Valid HSTS header; Max-age: 31,536,000 seconds; includeSubDomains: Present; preload: Present; Preload eligible: Yes

FAQ

What does the max-age directive do?

The max-age directive specifies how long, in seconds, the browser should remember to only access the site using HTTPS. After this period expires, the browser will allow HTTP connections again unless the header is refreshed.

Is includeSubDomains required for HSTS preload?

Yes. Browsers require the includeSubDomains directive for any domain submitted to the HSTS preload list. Without it, subdomains could still be accessed over HTTP, which defeats the purpose of preloading.

Can I undo HSTS if I make a mistake?

You can send a header with max-age=0 to clear the policy from browsers that visit your site, but only visitors who reconnect over HTTPS will receive it. If your domain is on the preload list, removal takes months because browsers ship updated lists infrequently.

Does this hsts checker contact my server?

No. This tool runs entirely in your browser. It either builds a header from your inputs or parses a string you paste locally. No network requests are made to your server or any external service.

What is the difference between preload and includeSubDomains?

The includeSubDomains directive extends the HTTPS-only rule to all subdomains of the current host. The preload directive signals to browsers that you want your domain added to a hardcoded list shipped with the browser, enforcing HTTPS before any connection is made.

Should I enable HSTS on a new site immediately?

It is safer to start with a very short max-age and no includeSubDomains flag. Once you confirm that all resources load correctly over HTTPS, gradually increase the max-age to avoid locking out visitors due to misconfiguration.

Does the checker accept quoted max-age values?

Yes. RFC 6797 allows max-age="31536000" with quotes, and the validator reads it. It rejects values that are not whole numbers, a missing max-age, repeated directives, and values above 2,147,483,647 seconds.