HSTS Checker

HSTS (HTTP Strict Transport Security) is a security mechanism that tells the browser: all subsequent connections to this site must use HTTPS only. The Strict-Transport-Security header is sent by the server in the HTTP response, and after receiving it, the browser automatically converts all HTTP requests to the domain into HTTPS without making an insecure connection.

HSTS Header Parameters

• max-age — time in seconds during which the browser will force HTTPS. Recommended value is 31536000 (1 year)
• includeSubDomains — extends HSTS policy to all subdomains. Important for protection against subdomain attacks
• preload — allows adding the domain to the browser HSTS preload list, so protection works from the very first visit

Why HSTS Is Important for Security

Without HSTS, the first connection to a site may be made over HTTP, creating a window for a man-in-the-middle (MITM) attack. An attacker can intercept the unprotected request and redirect the user to a phishing site. HSTS eliminates this vulnerability — the browser will never send an HTTP request to a domain with an active HSTS policy.

How to Configure HSTS

• Nginx — add to config: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
• Apache — use: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
• HSTS Preload — after configuring the header, submit your domain to hstspreload.org for inclusion in the browser preload list

HSTS and SEO

Proper HSTS configuration indirectly improves SEO. It ensures search bots always access the HTTPS version of pages, eliminates content duplication between HTTP and HTTPS, and speeds up loading by removing HTTP-to-HTTPS redirects. Google considers HTTPS a ranking factor, and HSTS ensures its unconditional use.