Advanced HSTS Preload Checker

Mastering HSTS Preloading: A Complete Guide

What is the HSTS Preload List?

The HSTS preload list is a list of domains baked into Google Chrome (and used by Firefox, Opera, Safari, Edge, and IE) that are hardcoded to be HTTPS-only. This means that even the very first connection to your domain is secure, preventing any opportunity for a man-in-the-middle attack to intercept the initial HTTP redirect.

Requirements for HSTS Preloading

To be accepted into the HSTS preload list, your site must serve a valid HSTS header on the response associated with the HSTS policy. The requirements are strict:

• Valid Certificate: Verify that you have a valid certificate for your domain.
• Redirect HTTP to HTTPS: Redirect all HTTP traffic to HTTPS on the same host.
• Serve all Subdomains: Serve all subdomains over HTTPS.
• HSTS Header on Base Domain: Serve an HSTS header on the base domain for HTTPS requests.
• Max-Age: The max-age must be at least 31536000 seconds (1 year).
• includeSubDomains: The includeSubDomains directive must be specified.
• Preload Directive: The preload directive must be specified.

How to Enable HSTS?

You enable HSTS by adding a response header to your web server configurations. Here are examples for common servers:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Why use this Tool?

Checking eligibility manually can be tedious. This Advanced HSTS Preload Checker validates all criteria instantly, checks if you are already on the list (or pending), and identifies exactly what is missing if you aren't compliant. It provides a deeper insight than standard header checkers by querying the official HSTS Preload API status.