HSTS preload checker
Paste your Strict-Transport-Security response header. We grade it against hstspreload.org's requirements.
Paste a header value
Why preload? Without preload, the first HTTP request to a new browser/device is still vulnerable to SSL strip. Preload bakes the HSTS promise into Chrome (and downstream browsers) so the FIRST connection is HTTPS too. Once you commit, removal takes months — verify every subdomain serves HTTPS first.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
CORS policy analyzer
Catch wildcard + credentials bugs