HSTS check without redirects

Inspect the header at the known canonical address itself.

Methodology: This check follows wSEO methodology 1.1. How the assessment works

Independent HSTS check

Find one valid header on the exact HTTPS address

Test the established canonical address without moving to another domain or page. If it redirects, repair the primary hostname first.

HSTS is checked in browser response headers and a terminal while duplicate headers are flagged
You need one Strict-Transport-Security header with a positive max-age.

Browser check

  1. Open the exact canonical HTTPS address and Developer Tools.
  2. Reload the page on the Network tab.
  3. Select the first request for the main HTML document.
  4. Find Strict-Transport-Security under Response Headers.
  5. Confirm there is one header and max-age is positive.

Assessing the result

Common check results
ResultMeaningAction
No headerHSTS is inactiveConfigure
max-age=0The policy is being disabledRepair
Positive max-ageHSTS is activeExpected
Multiple headersConfiguration sources conflictKeep one

Terminal check

curl -sS -D - -o /dev/null \
  --max-redirs 0 https://example.com/

The command deliberately does not follow redirects.

Preload is checked separately

Use the official HSTS Preload website. A preload directive does not itself prove list inclusion.

Save the exact URL, Response Headers screenshot and header value as evidence.

Sources and documentation

  1. MDN — Strict-Transport-Security header (link checked 2026-07-22) Supports: Official definition, expected result and limitations of the described diagnostic method.
  2. Chromium — HSTS Preload List Submission (link checked 2026-07-22) Supports: Official definition, expected result and limitations of the described diagnostic method.

An Automatic check is available at the top of this page. You can independently confirm its result using the manual verification instructions, then fix the issue yourself or order a professional fix.