# HSTS checker

> Check a site's Strict-Transport-Security header, how its grade is scored, and which hstspreload.org requirements it meets.

Source: https://docs.vigilbase.com/tools/hsts-checker

The HSTS Checker reads a site's `Strict-Transport-Security` header, grades it and checks it against the submission requirements of [hstspreload.org](https://hstspreload.org/). It uses the [Security headers](https://docs.vigilbase.com/tools/security-headers) scan, so the request is non-intrusive. Run it at [vigilbase.com/tools/hsts-checker](https://vigilbase.com/tools/hsts-checker).

## How the grade is scored

| Header | Score |
| --- | --- |
| `max-age` of at least one year (`31536000`) | 90 |
| `max-age` of at least 30 days | 75 |
| `max-age` of at least one day | 60 |
| Shorter `max-age` | 45 |
| `includeSubDomains` | Adds 10 |
| Missing, invalid, or `max-age=0` | 0 |

`preload` adds nothing to the score, because hstspreload.org does not recommend preloading for every site.

The grade uses the same bands as the [CSP evaluator](https://docs.vigilbase.com/tools/csp): A+ 95-100, A 85-94, B 70-84, C 55-69, D 40-54, F 0-39. A one-year `max-age` with `includeSubDomains` scores 100.

## Preload requirements

The checker lists each hstspreload.org requirement it can see:

| Requirement | How it is checked |
| --- | --- |
| Serves HTTPS with a valid certificate | The scan reached the site over HTTPS. |
| Header is on the base domain | The checked host is the registrable domain, not `www` or another subdomain. |
| Header read from the base domain's own response | The final response after redirects is on the same host. If the base domain redirects, hstspreload.org requires the redirect response itself to carry the header. |
| max-age is at least 31536000 seconds (one year) | Read from the header. |
| includeSubDomains is set | Read from the header. |
| preload is set | Read from the header. |
| HTTP redirects to HTTPS on the same host | Cannot be seen from this scan; check it yourself. |
| Every subdomain serves HTTPS | Cannot be seen from this scan; check it yourself. |

Passing every visible requirement does not mean the domain will be accepted: hstspreload.org makes that decision.

## Fix common findings

- **Header missing.** Serve every page over HTTPS, then send `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
- **Short max-age.** Raise it in steps once you are sure HTTPS works everywhere; browsers remember the value for that long.
- **No includeSubDomains.** Add it only when every subdomain serves HTTPS.
- **Preloading.** Add `preload` and submit the base domain at hstspreload.org only when you are ready to serve HTTPS on every subdomain for the long term.

## Report

You can email yourself the Security Headers report for the scanned URL. See [Report by email](https://docs.vigilbase.com/tools#report-by-email).