HSTS (RFC 6797) is a web security policy header that forces browsers to communicate with websites exclusively over secure HTTPS connections, preventing SSL stripping.
HTTP Strict Transport Security (HSTS) (RFC 6797) is an HTTP response header that instructs web browsers that the site must only be accessed over encrypted HTTPS connections, disallowing unencrypted HTTP and automatically upgrading insecure requests.
Inspect your server's HSTS directives using the HTTP Headers Analyzer, inspect TLS certificates with the SSL Decoder, or verify HTTPS redirect loops in the Redirect Checker.
| Directive | Requirement | Description |
|---|---|---|
max-age=<seconds> |
Required | Duration in seconds the browser must remember HTTPS enforcement (e.g. 31536000 = 1 year) |
includeSubDomains |
Optional | Applies HSTS policy to all subdomains (e.g. api.example.com, auth.example.com) |
preload |
Optional | Authorizes browser vendors (Google, Apple, Mozilla) to hardcode domain into global browser HSTS preload list |
Free, browser-based utilities to test, generate, and inspect HTTP Strict Transport Security (HSTS) payloads directly.
Analyze HTTP response headers for security, caching, and compliance issues.
Decode PEM & X.509 certificates offline or inspect live SSL/TLS certificate chains with expiration countdowns and health checks.
Trace URL redirect chains and detect 301, 302, 307, and 308 redirects.
