HSTS Preload Checker — Preload List Status

First-time visitors lack HSTS memory — attackers could strip TLS on initial HTTP request. Preloaded domains ship in browser source lists forcing HTTPS before any network contact, closing that gap for enrolled hostnames.

Preload is irreversible for months — mistaken inclusion strands users if HTTPS misconfigured. Check status before submission and after deployment.

Browsers aggregate submissions into canonical preload list distributed with updates. The hstspreload.org API exposes machine-readable status our checker queries live — not a cached unofficial mirror.

Source field in results confirms data provenance for audit documentation.

Domains need valid HTTPS, HSTS header with sufficient max-age, includeSubDomains directive, and preload directive on HTTPS responses. Redirect chains must satisfy policy checks defined by preload maintainers.

Eligibility false in API response points to specific remediation — inspect max-age, subdomain coverage, and redirect correctness on live site.

When true, every subdomain must serve valid HTTPS — dev stubs on http://test.example.com block preload approval. Plan wildcard certificates or ACME automation before enabling.

On-site HSTS protects repeat visitors after first successful HTTPS visit. Preload protects first visit globally. Many compliance frameworks now expect preload for public-facing properties handling sensitive data.

Approval takes weeks as browsers integrate list updates. Periodic checks track progression from pending to preloaded or rejected with reasons via API fields.

Insufficient max-age below policy threshold, missing preload token in header, HTTP redirect loops, or subdomain serving mixed content. Fix live headers then resubmit through official portal — our checker validates current list state not submission workflow.

Certificate validity underpins preload eligibility. Run SSL grade checker alongside preload status when rotating certificates before expiry.

HSTS complements Content-Security-Policy and Referrer-Policy. Security headers checker scores broader posture while this tool focuses preload list membership specifically.

We read list status only — we do not submit domains to preload program. Submission remains manual through maintainer website with email verification steps.