HSTS Preload Checker

How do I get my site on the HSTS preload list?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Serve HTTPS with a Strict-Transport-Security header of max-age at least 31536000 with includeSubDomains and preload, then submit the domain at hstspreload.org. This checker fetches your site over HTTPS, reads the header on the final response and shows which of the four header requirements are met.

The preload list is built into Chrome, Firefox, Safari and Edge. Preloaded domains are only ever contacted over HTTPS, even on the first visit, which closes the gap a plain HSTS header leaves.

Preloading is hard to undo: removal takes months to reach users' browsers, and includeSubDomains forces HTTPS on every subdomain, including internal ones. Make sure all of them serve valid HTTPS first.

How do I check HSTS preload eligibility?

Enter your apex domain, for example example.com.
Check each requirement. All four must be met.
Also make sure http://example.com redirects to https://example.com on the same host, which hstspreload.org requires and this check doesn't test.
Submit the domain at hstspreload.org.

How to read the results

HSTS header present: Whether the final HTTPS response sends Strict-Transport-Security. Redirects are followed, so if the apex redirects to www, this is www's header.
max-age ≥ 31536000: One year, the preload list's minimum.
includeSubDomains: Required for preloading.
preload: Your consent to be included in the list.

Common preload problems

Header is on www but not the apex

hstspreload.org checks the apex. Send the header from the apex's HTTPS response, including the response that redirects to www.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

An internal subdomain has no HTTPS

includeSubDomains will make browsers refuse it. Give it a valid certificate or move it to a different domain before preloading.

Examples and command-line equivalents

nginx

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Check the header yourself

curl -sI https://example.com/ | grep -i strict-transport

Frequently asked questions

How do I remove a domain from the HSTS preload list?

Submit a removal request at hstspreload.org and keep HTTPS working. Removal reaches users only as browsers update, which can take months.

Is a plain HSTS header enough?

It protects every visit after the first. Preloading also protects the first visit and visitors whose cached policy expired.