OneTaskBy Tim King · Updated
HSTS Preload Checker
Check max-age, includeSubDomains and Preload Against the Preload List Requirements
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the HSTS Preload Checker works
This HSTS preload checker tests a Strict-Transport-Security header against the rules browsers use for their built-in preload list. It shows which directives pass or fail and lists the server checks the submission site runs, so you can fix everything before you apply.
What the HSTS preload checker tests
The preload list is a set of domains compiled into Chrome, Firefox, Safari and Edge that are only ever
loaded over HTTPS, even on the very first visit. To join it, the header on your apex domain must have a
max-age of at least 31536000 seconds (one year), the includeSubDomains directive and the preload
directive. Repeated directives make the header invalid, and unknown ones are ignored.
Paste the header value on its own, the full Strict-Transport-Security: ... line or a whole block of
response headers. The checker picks out the HSTS line and tests each rule.
The header is only half of it. The domain also needs a valid certificate, a redirect from http:// to
https:// on the same host, HTTPS on every subdomain and the header on the apex response even when it
redirects. These are listed as checks to make yourself.
FAQ
How long does it take to get onto or off the preload list?
Once accepted, a domain reaches stable browsers with their next releases, which can take a couple of months. Removal takes just as long and older browser versions keep the entry, so only submit when you are sure every subdomain will stay on HTTPS.
Can I submit a subdomain such as www.example.com?
No. The list only accepts registrable domains such as example.com, and includeSubDomains then covers www and every other subdomain. Submitting the apex is exactly why every subdomain has to work over HTTPS first.
Should I start with the full one-year max-age?
Start with a short max-age such as 300 seconds, check that nothing breaks, then raise it to a week, a month and finally two years. A short value limits the damage if a forgotten subdomain turns out not to support HTTPS.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Security Headers Checker
Check pasted response headers for missing, weak and leaky security headers.
Security Headers Generator
Generate HTTP security headers for nginx, Apache, Netlify and Express.
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
HTTP Header Inspector
Parse pasted HTTP headers, explain each one and audit security.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.