Headers Security
medium Severity
Free Check
HSTS Preload Eligibility
Verifies if your HSTS configuration meets Chromium preload requirements (max-age ≥ 1 year, subdomains, preload).
Why It Matters
Without preloading, a user’s initial visit is vulnerable to SSL-stripping before the browser receives the HSTS response header.
How We Check This
We check whether max-age is at least 31536000, includeSubDomains is declared, and the preload token is present on the root apex domain.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
Frequently Asked Questions
Can I remove my domain from HSTS preload later?
Removal from browser preload lists can take months to propagate to all end-user browsers.