Bulk HSTS checker: which sites send a Strict-Transport-Security header?
In short: Paste a list of domains and read each site's Strict-Transport-Security header: max-age, includeSubDomains and preload, as a CSV. Limit: Only the home page's response headers are read.
A bulk HSTS checker reads the Strict-Transport-Security response header of each site's home page over HTTPS. Paste up to 100 domains, or 500 after a free Google sign-in; each row shows max-age, includeSubDomains and preload and says No HSTS header, short max-age, set, or meets the preload header requirements. Download the CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example sends a one-year HSTS header with includeSubDomains and preload.
- Site
- acme.example
- max-age
- 31536000 (1 year)
- includeSubDomains
- yes
What this means for you
The header is read over HTTPS only; the preload list's other conditions aren't checked.
- Reads Strict-Transport-Security
- Shows max-age in days
- Checks includeSubDomains and preload
- Flags missing and short headers
- Preload-ready
- Missing
- CSV
By SimpleVerifier Team · Last updated
Cleaning a list of company websites before outreach?
- Paste the domains here: 100 a run, or 500 after a free Google sign-in. Filter to the flagged rows and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check HSTS on many websites?
- Paste up to 100 domains, or 500 after a free Google sign-in, one per line; emails and URLs work too. You can also upload a CSV.
- Press Check HSTS headers. Each domain's home page is requested once, five at a time.
- Read each row: the header value, its max-age in days, and whether includeSubDomains and preload are set.
- Filter to the flagged rows and download the CSV.
Example
- You enter
- Three sites:
acme.example(max-age 31536000, includeSubDomains, preload),globex.example(max-age 86400) andinitech.example(no header). - You get
- acme.example: HSTS header meets preload requirements. globex.example: HSTS set, short max-age (1 day). initech.example: No HSTS header. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 sites a request; one request per site from our server, no cookies, nothing stored.
What is HSTS?
HTTP Strict Transport Security is a response header that tells browsers to use HTTPS only for a site for a set time, defined in RFC 6797. Browsers ignore it when it is sent over plain HTTP.
The preload list asks for a max-age of at least one year (31,536,000 seconds), includeSubDomains and preload; see hstspreload.org.
What do the rows mean?
No HSTS header and a max-age under a year are flagged. Meets preload requirements means the header has all three directives; it doesn't check the HTTP redirect or every subdomain.
Only the home page's response headers are read. For the full set of security headers on one site, use the security headers checker. For a plain live-or-down read of every site, use the bulk website status checker.
What do you do with the flagged rows?
Add or lengthen the header at the web server, once HTTPS works on every subdomain you cover, or keep the rows as security-audit prospects.
Before you email contacts at these companies, verify the addresses.
Who uses this tool, and for what?
- Security consultants
- Triage prospects' transport security in one run.
- Web agencies
- Check client sites after an HTTPS move.
- IT teams
- Audit the domains you run.
- Site owners
- Confirm the header survived a server change.
What can’t this tool tell you?
- Only the home page's response headers are read.
- Subdomains and the HTTP redirect aren't checked.
- A header set by a different host on another path isn't seen.
- Up to 100 domains a run without an account, 500 signed in.
- Public HTTP only: each row is a signal read from the site, not a certainty.
Common questions
- How do I check if a site uses HSTS?
- Paste the domain into a bulk HSTS checker like this one. It reads the Strict-Transport-Security header over HTTPS.
- Is this HSTS checker free?
- Yes. 100 domains a run without an account, 500 after a free Google sign-in, with no card, and a CSV download.
- Does it check the preload list?
- No. It checks whether the header meets the preload rules, not whether the domain is on the list.
- What if a site only answers on HTTP?
- The row says there is no HTTPS to read HSTS from.
- Can HSTS lock me out of a site?
- Yes if HTTPS breaks, since browsers refuse plain HTTP for the max-age. Test before you raise it.
- Does it check my contacts' email addresses?
- No. Verify them separately at /verify.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.