← All checks

HTTPS and HSTS header checker

We check that the final URL after redirects uses https, and that the response has a Strict-Transport-Security header with max-age above zero.

Why it matters

An agent that follows a link to your site over HTTP can be served altered content on the way, and many agents refuse to act on pages like that. HSTS tells the client to use HTTPS only for the stated period. HTTPS is worth 1 point and the HSTS header the second.

How to fix it

1. Install a valid certificate and redirect all http:// URLs to https:// with a 301.
2. Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains.
3. Set the header at the web server or CDN, so every response has it.
4. Start with a short max-age while you test, then raise it.

How to verify

Run curl -sI https://example.com/ | grep -i strict-transport and expect a max-age value.

Check your site free

Scan a site

Related checks

• About / contact
• Legal / privacy
• AI policy / content signals
• No cloaking

All checks