What is an HSTS Checker?
Without HSTS, every “first visit” types http:// and can be intercepted before the redirect to HTTPS. HSTS makes browsers refuse plain HTTP for your domain for a declared period.
This checker reads the live header and grades the three knobs: max-age duration, includeSubDomains, and whether the config qualifies for browser preload lists.
Frequently asked questions
What max-age should I set?
One year (31536000) is the standard; six months is the working minimum. Short values leave repeat gaps.
What does preload mean?
Browsers ship a built-in list of HSTS domains, protecting even the first-ever visit. Qualify (1yr + includeSubDomains + preload token), then submit at hstspreload.org.
Any risk in enabling it?
Only if some subdomain still needs plain HTTP: includeSubDomains will break it. Audit subdomains first; preload is effectively permanent.
Does HSTS replace the HTTP→HTTPS redirect?
No: keep the redirect for first contact; HSTS protects every visit after it.