HSTS Tester

HTTP Strict Transport Security is a response header that tells browsers to only ever connect to your site over HTTPS for a set time (max-age). It stops downgrade and cookie-hijacking attacks. includeSubDomains extends it to every subdomain, and preload lets you submit the domain to a list browsers ship with, so even the very first visit is forced to HTTPS — which requires max-age of at least one year plus includeSubDomains and preload.

The request runs on Uptimeify's EU servers, and the domain you enter is used only for the test and is not stored. The fetcher only allows http and https and refuses to connect to private or internal addresses. As an EU-built, EU-hosted provider, we keep this off US infrastructure and clear of US Cloud Act exposure, which matters for agencies handling client data under GDPR.

HSTS and a working HTTPS redirect are easy to lose during a deploy or certificate change. Verify them here, then let Uptimeify watch the site and its certificate continuously and alert you the moment HTTPS, the redirect or the certificate breaks.