Verify HSTS Configuration for Enhanced Security
HTTP Strict Transport Security (HSTS) forces browsers to use HTTPS connections even if users type HTTP. This tool checks if a domain has HSTS enabled and shows the configuration details including max-age, subdomain coverage, and preload eligibility.
Why HSTS Matters
- Prevents downgrade attacks: Browsers won't accept HTTP connections once HSTS is cached.
- Protects cookies: Reduces risk of session hijacking over insecure connections.
- First-visit protection: When combined with preload lists, provides security even on first visit.
What This Tool Checks
- HSTS header presence: Whether the Strict-Transport-Security header is sent.
- Max-age duration: How long browsers cache the HSTS policy (recommended: ≥31536000 seconds / 1 year).
- includeSubDomains: Whether the policy applies to all subdomains.
- preload directive: Whether the site is eligible for browser preload lists.
- Additional security headers: CSP, X-Frame-Options, and other security configurations.
Best Practices
- Use max-age of at least 31536000 (1 year) for long-term protection.
- Enable includeSubDomains to cover all subdomains.
- Consider preload for sites that exclusively use HTTPS.
- Test HSTS configuration before deploying to production.
Implementation Notes
- HSTS is only effective after the first HTTPS connection.
- Preload requires manual submission to browser vendor lists.
- Once enabled, HSTS persists for the max-age duration even if removed.