HSTS preload checker

What the preload list does

A Strict-Transport-Security header tells a browser to use HTTPS for a site from then on, but only after its first visit, and that first request can still go out over plain HTTP. The preload list closes that gap: domains on it are built into Chrome, Firefox, Safari and Edge, which never connect to them, or any of their subdomains, without HTTPS.

Domains are submitted at hstspreload.org, which checks the site, queues it, and adds it to Chrome's list. The other browsers copy that list.

What the checker tests

• A trusted certificate on https://<domain>/.
• Exactly one Strict-Transport-Security header on the first HTTPS response, with max-age of at least 31536000 (one year), includeSubDomains and preload. If that response is a redirect, the header must be on the redirect itself.
• HTTP to HTTPS on the same host: http://example.com/ must redirect to https://example.com/ before going anywhere else, such as www. A closed port 80 is also fine.
• HTTPS on www: if www.<domain> has DNS records, it must serve HTTPS with a valid certificate.
• No more than three redirects, none of them back to plain HTTP.
• The domain's status on the list (not submitted, pending, preloaded, rejected or being removed) and hstspreload.org's own errors and warnings, from its public API.

A subdomain is checked as its registrable domain, because only whole domains can be submitted.

Before you submit

includeSubDomains and the list apply to every name under the domain: intranet hosts, staging sites, webmail, printers and devices with their own certificates. Anything that only works over HTTP stops working in browsers. Check every subdomain first; a certificate search for the domain is a good way to find forgotten ones.

Roll out in steps: start with a short max-age such as 300 (five minutes) and includeSubDomains, raise it to a week, then a month, and only add preload with a two-year max-age once nothing has broken.

• The recommended header is Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
• Send it on every HTTPS response from the apex, including redirects. Many platforms (Vercel, Cloudflare, nginx) let you add it once at the edge.

Questions

How long does preloading take?

A pending domain is added to Chrome's list within a few weeks and ships with the next stable release, about every four weeks. Firefox, Safari and Edge follow over the next few months as they copy the list.

Can I get off the list?

Yes, through the removal form at hstspreload.org, but it is slow: the entry must be removed from Chrome's source, ship in a release, and reach users, and other browsers follow later. Plan for months, and keep HTTPS working on every subdomain in the meantime.

Why must HTTP redirect to the same host first?

The browser only learns the HSTS policy for the apex if it reaches the apex over HTTPS. Redirecting http://example.com straight to https://www.example.com skips that, so hstspreload.org requires http://example.com to go to https://example.com first, which can then redirect to www.

Do I still need the header once I'm preloaded?

Yes. Browsers without the list, or with an older copy, still learn the policy from the header, and hstspreload.org can remove domains that stop sending preload. Keep it on every HTTPS response.

My domain is pending but the checker shows failures. What happens?

Domains are checked again before they are added, and ones that no longer qualify are dropped from the queue. Fix the failures and keep the header in place until the domain shows as preloaded.