Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →To test HSTS, request your site over HTTPS and inspect the response headers. Confirm that the HTTPS response includes one valid Strict-Transport-Security header with the intended max-age. Then check the scope of includeSubDomains, if present, and verify that HTTP redirects to HTTPS. A header sent over HTTP does not enable HSTS.
What an HSTS test checks
HTTP Strict Transport Security (HSTS) is a browser policy that tells a browser to use HTTPS for future connections to a host. For a host with a stored HSTS policy, the browser also blocks users from bypassing certificate errors. The policy is declared with the Strict-Transport-Security response header, as described by MDN.
An effective check is more than finding the header somewhere in a request trace. The header must arrive on an HTTPS response, its value must be valid, and its scope and duration must match what your site can safely support.
Check HSTS from the command line
Use curl to see the redirect chain and response headers without relying on browser display or a third-party scanner. Replace example.com with your hostname. These commands require curl installed and access to the target site.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
Inspect HTTPS and redirects
-
Request the HTTPS URL and show each response header block:
curl -sS -D - -o /dev/null -L https://example.com/-D -prints response headers,-o /dev/nulldiscards the page body, and-Lfollows redirects. Review each status line and header block. The final HTTPS response serving the page should contain the HSTS policy. If the URL redirects to another host, inspect the final host separately: HSTS policy is host-specific. -
Check the HTTP entry point:
curl -sS -D - -o /dev/null -L http://example.com/Confirm the initial HTTP response redirects to HTTPS and that the final destination is the expected secure URL. HSTS is not learned from the HTTP response, so a header appearing there does not substitute for an HSTS header on HTTPS.
-
Repeat for relevant production hostnames and representative paths. A successful result on the apex host does not prove that separate subdomains or alternate application routes are configured correctly.
Recommended: Fix Windows Errors and Clear Junk Files in Minutes - Free Scan →Recommended: Crashes or Glitches? A Free Driver Scan Usually Finds the Culprit →Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
To retain details for troubleshooting, write headers to a file with -D headers.txt. If you need to inspect a particular redirect hop, omit -L and query that URL directly; then test the Location destination as its own HTTPS request.
Validate the header value and scope
The standard form is Strict-Transport-Security: max-age=<seconds>; includeSubDomains; preload. max-age is mandatory; includeSubDomains and preload are optional. Directives are separated by semicolons. Mozilla’s guidance is available in its web security guidelines.
- Exactly one effective policy: Make sure the HTTPS response has one unambiguous HSTS policy. If multiple layers such as an origin server and CDN add the header, inspect the actual response and configure one source of truth rather than assuming duplicate values combine safely.
max-ageis a positive integer: It defines how long, in seconds, the browser retains the policy. Zero removes a previously stored policy; it is not a useful active protection period. Check that the value is an integer greater than zero and matches your rollout plan.includeSubDomainsis a site-wide commitment: It applies the policy to every subdomain, not only the hostname that sent the header. Check the apex and all production subdomains for working HTTPS before enabling it. An abandoned, vendor-hosted, or legacy subdomain without valid HTTPS can become inaccessible to browsers that have stored the parent policy. See MDN’s TLS implementation guide.preloadsignals intent, not enrollment: Adding the directive alone does not place a site in browser preload lists. MDN says preload requires amax-ageof at least31536000seconds (one year) andincludeSubDomains; the site must also be submitted to the preload service for list inclusion.
Choose a max-age and deployment scope
A longer policy improves persistence for browsers that have received it, but makes mistakes slower to roll back: browsers retain the setting until the stated expiration unless they receive an updated policy. Pick a duration your team can support operationally.
| Approach | Value and scope | When it fits | Trade-off |
|---|---|---|---|
| Short rollout | A positive, shorter max-age; host only |
Initial deployment while confirming HTTPS behavior | More rollback flexibility, but policy expires sooner and provides less durable protection. |
| Longer-lived host policy | MDN’s TLS guide cites six months (15768000 seconds) as a minimum deployment value and two years (63072000 seconds) as a longer recommendation. |
A host whose HTTPS configuration is stable | Browsers retain the policy longer, so recovery from a configuration mistake takes more planning. |
| Include subdomains | Add includeSubDomains to the chosen policy |
Every subdomain under the domain can reliably serve HTTPS | Expands impact to all subdomains, including services managed by other teams or vendors. |
| Preload path | At least 31536000 seconds, includeSubDomains, plus separate submission |
A deliberate commitment to strict HTTPS coverage, including before a browser has visited securely | Preload-list inclusion is a separate process; removal and browser list updates are not an instant rollback. |
The values above are current MDN guidance, not a substitute for assessing your subdomain inventory or deployment controls. RFC 6797, the IETF HSTS specification published in November 2012, describes policy declaration, browser upgrades for known HSTS hosts, and retention for the declared period; see the RFC Editor entry.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand first-visit protection and preload
Ordinary HSTS begins protecting a browser only after it has made a secure connection and received the header. Before that, a first visit that starts over insecure HTTP is not protected by that browser’s stored HSTS policy. MDN describes this as a weakness of HSTS. Preloading can mitigate the first-visit gap for domains included in browser preload lists, but only after meeting the requirements and completing the separate submission process.
Rank #4
Preload is therefore not just another header toggle. It is a broader operational commitment: subdomains must support HTTPS, the header must meet the required duration and scope, and enrollment must be requested separately. Do not add preload merely because the word appears in a scanner recommendation.
Retest after deployment changes
Run the checks again after changes to a reverse proxy, CDN, load balancer, web server, or application middleware. Any of those layers can add, replace, or remove response headers. Test from outside your infrastructure so you see the response clients actually receive, and confirm that HTTPS behavior remains correct on each hostname covered by the policy.
Troubleshoot common HSTS test failures
- No HSTS header on HTTPS: The application or edge layer may not be configured to send it, or a later proxy may remove it. Inspect the public HTTPS response and configure the layer responsible for the final response.
- Header appears only on HTTP: Browsers ignore HSTS received over insecure HTTP. Configure the policy on the HTTPS response and make HTTP redirect to HTTPS.
- Unexpected or duplicate values: Multiple infrastructure layers may be adding the header. Identify the origin of each value and leave one intended policy on the served HTTPS response.
- Subdomain breaks after adding
includeSubDomains: A covered hostname may lack working HTTPS or a valid certificate. Restore HTTPS for that hostname or remove the broad scope through a controlled change; browsers that already stored the parent policy may continue enforcing it until its expiration or an updated policy is received. - Preload scanner accepts the header but the domain is not preloaded: The directive does not itself enroll the domain. Verify the required header settings and complete the separate submission process.
- curl reports a certificate error: curl validates certificates by default. Fix the certificate chain, hostname, or validity problem; disabling verification can hide a real defect and should not be treated as a successful HTTPS check.
- Different responses from different requests: A CDN, regional edge, or inconsistent backend may be serving different headers. Repeat requests, compare response headers and destinations, then make the configuration consistent across serving paths.
Or skip the browser setup
If you need a visual record of how a page appears, ScreenshotNeo can capture a screenshot or PDF through one GET request; it is a screenshot service, not an HSTS validator, so use the header checks above to verify the policy. See the ScreenshotNeo API documentation.
Best Value
- Used Book in Good Condition
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webp
ScreenshotNeo accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing, with the response indicating the page verdict and billing status. An MCP server provides screenshot tools for AI agents, and the free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Sign up free for ScreenshotNeo.
Frequently Asked Questions
Does an HSTS header on an HTTP response count?
No. Browsers ignore HSTS delivered over HTTP; the policy must be sent on an HTTPS response.
Does adding the preload directive put my site on browser preload lists?
No. The directive indicates intent; the required policy and a separate submission process are needed for list inclusion.
Does a successful curl check prove every browser is protected on its first visit?
No. Ordinary HSTS takes effect for a browser after it has received the header over HTTPS; preload can mitigate that first-visit gap for enrolled domains.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
