How to Check HSTS Headers on Many Websites at Once

Whether a site pins browsers to HTTPS is answered by one response header, Strict-Transport-Security, and it can be read for a whole list of domains. The bulk HSTS checker does this for up to 100 domains at once (500 after a free Google sign-in) and shows max-age, includeSubDomains and preload for each.

A row reading No HSTS header or a short max-age is a flag to review, not proof a site is insecure.

What HSTS is

HTTP Strict Transport Security tells browsers to use HTTPS only for a site for a set time, defined in RFC 6797. Browsers ignore it when it arrives over plain HTTP. The preload list asks for a max-age of at least one year (31,536,000 seconds), includeSubDomains and preload; see hstspreload.org.

The by-hand way

1. Run curl -sI https://example.com and look for strict-transport-security.
2. Read max-age and check for includeSubDomains and preload.
3. Repeat for every domain, or script a loop yourself.

Step 1: paste the domains

One per line, or a CSV.

Step 2: run the check

Each home page is requested once over HTTPS, five at a time.

Step 3: read the rows

You get the header value, max-age in days and the two directives. No HSTS header and a max-age under a year are flagged; Meets preload requirements means all three directives are present. Download the CSV. For every security header on one site, use the security headers checker.

What this check cannot do

• Only the home page's response headers are read.
• Subdomains and the HTTP redirect aren't checked; see the HTTP to HTTPS redirect checker for the latter.
• A header set on another path isn't seen.
• Raise max-age only once HTTPS works on every subdomain you cover.

Next: contact emails

This tool reads websites. For the emails on the same list, verify them: the first 100 checks are free with a Google sign-in.

Try it now

Paste your domains into the bulk HSTS checker.