HSTS Analyzer
Paste a Strict-Transport-Security value, header line, or full HTTP response to review max-age, includeSubDomains, preload, duplicate directives, malformed values, and preload-related review points. Analysis runs entirely in your browser.
Analyze a pasted Strict-Transport-Security value or full HTTP response headers and review max-age, includeSubDomains, preload, duplicates, and malformed directives locally.
How to analyze HSTS
- Paste an HSTS value, header line, or complete response header block.
- Run the analyzer to view each detected policy, max-age, includeSubDomains, preload, and issue counts.
- Review errors for missing or invalid max-age and warnings related to preload requirements, repeated headers, or zero max-age.
What the analyzer checks
max-age is required and must be a non-negative integer. includeSubDomains and preload are treated as flags and are errors if given values; duplicate directives are errors.
When preload is present, max-age below 31,536,000 seconds and missing includeSubDomains are review conditions. A zero max-age is also marked for review.
Privacy and limitations
Only pasted header text is analyzed in your browser. The tool does not connect to the hostname, verify HTTPS redirects or certificates, check the browser HSTS cache, or confirm inclusion in any external preload list.
HSTS Analyzer FAQ
Does it check my domain automatically?
No. Paste the HSTS value or headers.
Is max-age required?
Yes. Missing or invalid max-age is reported as an error.
What preload lifetime does this tool review against?
It uses 31,536,000 seconds as the minimum age check when preload is present.
Does it check the real preload list?
No. It only reviews the pasted policy structure.
Does the analyzer make network requests?
No. It runs locally in the browser.