HSTS Checker
Paste response headers and check the Strict-Transport-Security header.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
HSTS Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
A max-age of 31536000 with includeSubDomains is reported as a strong HSTS header in the pasted text.
What this tool does not do / Limits
This only reads headers you paste. A preload directive in a header does not prove the site is on the preload list, and nothing here tests a live site.
Frequently asked questions
Does this prove a site is preloaded?
No. The preload directive is only a request; listing is decided by the preload list itself.
Does it test my live site?
No. It only reads the header text you paste.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live