HSTS Check

What It Does

Fetches the Strict-Transport-Security header from the domain, parses all directives (max-age, includeSubDomains, preload), validates against preload requirements (max-age ≥ 31536000, includeSubDomains required, preload directive required), and queries the hstspreload.org API to check if the domain is already on the browser preload list. Returns human-readable max-age formatting and specific remediation guidance for any issues found.

Why It's Useful

HSTS (RFC 6797) protects against SSL stripping and protocol downgrade attacks by ensuring browsers only connect via HTTPS. Without HSTS, an attacker on the same network can intercept the initial HTTP request and redirect to a malicious site. Preload list inclusion provides protection from the very first visit — critical for high-security applications. HSTS is required by PCI DSS 4.0.1 and recommended by OWASP and NIST SP 800-52r2 (Guidelines for TLS Implementations).

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/domain/hsts" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=google.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/domain/hsts?domain=google.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/hsts',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'google.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.