HSTS Security Checker

What is HTTP Strict Transport Security?

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers should only interact with it using secure HTTPS connections.

• Enforcement: Browsers memorize the HSTS policy and will automatically rewrite any http:// links to https://.
• No Downdrades: Attackers cannot trick the user into connecting via an unencrypted channel.
• Preloading: High-security sites can be hard-coded into the browser's source code as HTTPS-only.

Why HSTS is Critical for Compliance

Standard HTTPS redirects are not enough. On the very first request, or if a user types a URL without the prefix, the browser starts with HTTP. HSTS closes this "vulnerability window" by ensuring the browser never even attempts an insecure connection.

"HSTS is the final step in securing your HTTPS implementation. It effectively turns a recommendation to use HTTPS into a strict, unbreakable requirement for the browser."

Implementation Examples

Adding HSTS is done via a single HTTP response header. Here is how to add it to the most popular web servers:

How to Use This Tool

Enter the full hostname of your website and click "Verify HSTS". Our tool will simulate a browser request to your server and check for the existence of the Strict-Transport-Security header. We'll also parse the max-age, subdomains, and preload flags to ensure your policy is correctly configured for maximum security.