Navigation
VigilbaseDocs

    Type at least two letters.

    Open Vigilbase One

    HSTS checker

    Check a site's Strict-Transport-Security header, how its grade is scored, and which hstspreload.org requirements it meets.

    View as Markdown
    On this page
    1. How the grade is scored
    2. Preload requirements
    3. Fix common findings
    4. Report

    The HSTS Checker reads a site's Strict-Transport-Security header, grades it and checks it against the submission requirements of hstspreload.org. It uses the Security headers scan, so the request is non-intrusive. Run it at vigilbase.com/tools/hsts-checker.

    How the grade is scored

    HeaderScore
    max-age of at least one year (31536000)90
    max-age of at least 30 days75
    max-age of at least one day60
    Shorter max-age45
    includeSubDomainsAdds 10
    Missing, invalid, or max-age=00

    preload adds nothing to the score, because hstspreload.org does not recommend preloading for every site.

    The grade uses the same bands as the CSP evaluator: A+ 95-100, A 85-94, B 70-84, C 55-69, D 40-54, F 0-39. A one-year max-age with includeSubDomains scores 100.

    Preload requirements

    The checker lists each hstspreload.org requirement it can see:

    RequirementHow it is checked
    Serves HTTPS with a valid certificateThe scan reached the site over HTTPS.
    Header is on the base domainThe checked host is the registrable domain, not www or another subdomain.
    Header read from the base domain's own responseThe final response after redirects is on the same host. If the base domain redirects, hstspreload.org requires the redirect response itself to carry the header.
    max-age is at least 31536000 seconds (one year)Read from the header.
    includeSubDomains is setRead from the header.
    preload is setRead from the header.
    HTTP redirects to HTTPS on the same hostCannot be seen from this scan; check it yourself.
    Every subdomain serves HTTPSCannot be seen from this scan; check it yourself.

    Passing every visible requirement does not mean the domain will be accepted: hstspreload.org makes that decision.

    Fix common findings

    • Header missing. Serve every page over HTTPS, then send Strict-Transport-Security: max-age=31536000; includeSubDomains.
    • Short max-age. Raise it in steps once you are sure HTTPS works everywhere; browsers remember the value for that long.
    • No includeSubDomains. Add it only when every subdomain serves HTTPS.
    • Preloading. Add preload and submit the base domain at hstspreload.org only when you are ready to serve HTTPS on every subdomain for the long term.

    Report

    You can email yourself the Security Headers report for the scanned URL. See Report by email.