What does a security header checker do?

A security header checker reviews HTTP response headers that help protect a website, including HSTS, Content Security Policy, preload directive, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Are security headers important?

Yes. Security headers can help reduce risks related to clickjacking, MIME sniffing, insecure HTTP access, referrer leakage, and unsafe browser behavior.

Does a security header checker replace a full security audit?

No. A security header checker is useful for spotting missing browser security headers, but it does not replace a full website security audit.

Free HSTS & HTTPS Security Tool

Free HSTS checker for testing HTTPS enforcement.

Check whether a website is using the HSTS max-age header and review max-age, includeSubDomains, preload, and HTTPS enforcement details.

✓ No signup required ✓ Security header report ✓ Built-in abuse protection

How the HSTS checker works.

This tool checks a website’s HTTPS response headers and extracts the HSTS max-age header.

Enter a domain

Type a domain like example.com. The tool validates the domain before checking the headers.

Scan HSTS header

The checker reads the website’s HTTPS response and checks for the HSTS max-age header.

Review HSTS details

See whether HSTS is enabled, how long max-age is set for, and whether includeSubDomains or preload are configured.

HSTS details this tool checks.

HSTS helps browsers remember to use HTTPS for future visits after a secure connection has been established.

HST

HSTS max-age

Shows how long browsers should remember to use HTTPS.

CSP

includeSubDomains

Checks whether HSTS also applies to subdomains.

XFO

preload directive

Checks whether the preload directive is present for HSTS preload readiness.

HSTS checker FAQ.

Quick answers about HSTS, HTTPS enforcement, max-age, includeSubDomains, preload, and SSL security.

What does this HSTS checker test?

It checks common HTTP security headers including HSTS, Content Security Policy, preload directive, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Is HSTS important?

Yes. HSTS helps force browsers to use HTTPS for future visits, reducing the risk of users accidentally loading insecure HTTP pages.

What is HSTS?

HSTS stands for HTTP Strict Transport Security. It tells browsers to use HTTPS for future visits after a secure connection has been established.

What does max-age mean in HSTS?

max-age tells browsers how many seconds to remember that the domain should only be loaded over HTTPS.

What does includeSubDomains mean?

includeSubDomains means the HSTS rule also applies to subdomains. Only enable it when all subdomains properly support HTTPS.

Can HostDroplet help with SSL setup?

Yes. HostDroplet provides beginner-friendly hosting with SSL support, security-focused setup, backups, and helpful website guidance.

Need hosting with stronger HTTPS security?

HostDroplet provides fast, secure, beginner-friendly hosting for WordPress websites, small business sites, blogs, and online projects. Start with hosting that supports SSL, backups, performance, and helpful security guidance.

Start Hosting Now