How to use it
- Enter the complete https:// URL you want to inspect.
- Select Check to request its final response headers.
- Confirm the final destination still uses HTTPS.
- Find Strict-Transport-Security in the Header column and read its Value.
- Use Copy Result to retain the raw directive.
The tool does not parse HSTS directives or determine preload eligibility. Its fallback inserts a fabricated HSTS header.
What is the purpose of the tool
HSTS Checker exposes the final response headers so the Strict-Transport-Security directive can be reviewed. The final URL and redirect count help confirm which response supplied the header.
The implementation does not score max-age, includeSubDomains, or preload. It also does not query a browser preload registry.
What parameters it generates in output
| Field | Meaning | Healthy result |
|---|---|---|
| Target Evaluated | The normalized starting URL. | It begins with HTTPS for an HSTS review. |
| Status badge | The final HTTP code and label. | The secure endpoint responds as expected. |
| Latency | Total header-request time. | Use it as response context. |
| Redirects | The number of followed redirects. | The secure destination is intentional. |
| Final Destination URL | The effective URL reached. | It remains on HTTPS. |
| Header | A parsed final header name. | Strict-Transport-Security is present. |
| Value | The raw directive paired with the header. | It contains the deployment's intended max-age and options. |
FAQs related to that specific tool
Does the page display a separate HSTS status?
No. It lists all final response headers and requires manual identification of Strict-Transport-Security.
Why must I test HTTPS directly?
Browsers only honor HSTS when it is delivered over a secure connection, so an HTTP response is not sufficient.
Does it evaluate max-age?
No. The raw header value is shown without threshold or expiry analysis.
Does the checker confirm preload eligibility?
No. It does not apply preload requirements or check a preload list.
Are includeSubDomains and preload parsed?
No. They may be visible inside Value, but no separate fields or verdicts are generated.
Can the fallback HSTS header be trusted?
No. The browser fallback fabricates a Strict-Transport-Security value.