HSTS Check

What It Does

Runs four parallel checks: (1) parses the apex HTTPS Strict-Transport-Security header (max-age, includeSubDomains, preload); (2) calls hstspreload.org /api/v2/status for current listing; (3) calls /api/v2/preloadable for the canonical pre-submission errors/warnings; (4) probes port 80 to verify HTTP→HTTPS redirect AND that the redirect response carries an HSTS header (preload requires it). Flags edge cases: `max-age=0` while `preload` is set (active removal), `max-age > 2y` (above Chromium cap).

Why It's Useful

HSTS (RFC 6797) protects against SSL stripping and protocol downgrade attacks by ensuring browsers only connect via HTTPS. Without HSTS, an attacker on the same network can intercept the initial HTTP request and redirect to a malicious site. Preload list inclusion provides protection from the very first visit — critical for high-security applications. HSTS is required by PCI DSS 4.0.1 and recommended by OWASP and NIST SP 800-52r2 (Guidelines for TLS Implementations).

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/domain/hsts" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=https://google.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/domain/hsts?domain=https%3A%2F%2Fgoogle.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/hsts',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'https://google.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.