HTTP headers
HSTS checker
Test whether your site sends Strict-Transport-Security with a proper max-age.
Free, non-invasive check in seconds. No signup.
Scan my website for freeHSTS forces browsers to always use HTTPS on your domain.
Why it matters
Without it, attackers on public Wi-Fi can downgrade connections and steal cookies.
How to fix
Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
FAQ
- Recommended max-age?
- At least 6 months; ideally one year.
Other free tools
- Free security headers checker
- Content-Security-Policy validator
- SSL / HTTPS checker
- DMARC, SPF and DKIM checker
- Exposed .env and .git checker
- WordPress security scanner
- Free website security test
- Is this website safe? Free checker
- Is this website legit or a scam?
- Fake online store checker
- Phishing link checker
- Check if a link is safe to open
- Free website vulnerability scanner
- SaaS security checklist for founders
- Website clone checker
- YouTube & TikTok scam video checker
- Security trust badge for your website
- Fake website checker
- Suspicious link checker
- How to check a domain's age
- Where does a short link go?
- Is this video a scam?
- Celebrity deepfake scam videos
- Betting signal bots and VIP groups
- How to report a scam video
- How to find cloned websites of your brand
- Free typosquatting domain checker
- How to take down a fake website
- Brand protection and domain monitoring
- Homograph domain attack checker
- How to report a phishing domain to Google