HSTS Preload Checker
Check if any domain is in the Chrome/Chromium HSTS preload list with our free HSTS Preload Checker. Enter a domain and the tool queries the official hstspreload.org API v2 to determine the preload status - Preloaded, Pending, Rejected, or Not Preloaded. Each status includes a detailed explanation of what it means, whether subdomains are covered, and guidance on next steps. All queries go directly from your browser to the API - no signup required.
Enter a domain name (protocol and path are stripped automatically).
Why Use Our HSTS Preload Checker?
Real-Time HSTS Preload Status Check
Query the official hstspreload.org API v2 in real time to check if a domain is in the Chrome/Chromium HSTS preload list. The tool returns one of four statuses: Preloaded (in the list), Pending (submitted and awaiting review), Rejected (did not meet requirements), or Not Preloaded (not in the list). Each status includes a detailed explanation of what it means for the domain.
Detailed Preload Information
Beyond the basic status, the HSTS Preload Checker reveals whether the domain was submitted via bulk submission, the actual preloaded domain (useful for subdomains covered by a parent entry), and the query response time. The results also include a direct link to hstspreload.org for further details and submission options.
Smart Status Descriptions & Guidance
Each HSTS preload status comes with a human-readable explanation and actionable guidance. If a domain is preloaded, the description explains the strength of the enforcement. If rejected, common reasons are listed. If not preloaded, guidance on how to submit the domain is provided.
Free & No Signup Required
Check as many domains as you want with no signup, no API key, and no usage limits. The HSTS Preload Checker queries the public hstspreload.org API directly from your browser - no data is stored or logged on our servers. Completely free, forever.
Common Use Cases for HSTS Preload Checking
Security Audit & Compliance
Security professionals use the HSTS Preload Checker to verify that client domains have the strongest possible HTTPS enforcement. Including a domain in the HSTS preload list ensures that browsers will never make an unencrypted HTTP request to that domain, protecting against downgrade attacks, SSL stripping, and man-in-the-middle attacks from the very first visit.
Browser Hardening Verification
Before a major website launch, verify that your domain is in the Chrome/Chromium HSTS preload list. Unlike server-driven HSTS (which requires at least one HTTP visit to learn the policy), preloaded domains get browser-level HTTPS enforcement on the very first connection. This eliminates the "first-load vulnerability" that affects standard HSTS implementations.
Preload Readiness Assessment
If your domain shows as "Not Preloaded" or "Rejected", use the HSTS Preload Checker to understand why. The tool explains the requirements: valid TLS certificate, permanent HTTP-to-HTTPS redirect, max-age ≥ 31,536,000 seconds (1 year), includeSubDomains directive, and the preload directive in the Strict-Transport-Security header.
Subdomain Coverage Verification
Check if subdomains are covered by a parent domain's preload entry. The HSTS Preload Checker shows whether a domain is covered through its parent domain (e.g., app.example.com covered by example.com). This is critical for verifying that all subdomains in your infrastructure have HSTS preload protection.
E-commerce & Banking Compliance
E-commerce sites, banks, and any websites handling sensitive user data should verify their HSTS preload status. Being in the preload list is a strong signal to users and regulators that the site takes HTTPS security seriously. Many security frameworks (PCI DSS, NIST) recommend or require HSTS enforcement.
Competitive Security Benchmarking
Compare HSTS preload adoption across competitors in your industry. Check whether major competitors have their domains preloaded, and use the results to make the case for implementing HSTS preload in your organization. The HSTS Preload Checker makes it easy to audit any domain in seconds.
Understanding the HSTS Preload List
What is the HSTS Preload List?
The HSTS preload list is a hardcoded list of domain names maintained by Google and shipped with the Chrome/Chromium browser source code. It is also used by Firefox, Safari, Edge, and Opera. When a domain is on this list, the browser will automatically upgrade all HTTP connections to HTTPSbefore any data is sent - even on the very first visit. This eliminates the “first-load vulnerability” where a user could be attacked before receiving the HSTS header from the server.
How Does HSTS Preload Differ From Standard HSTS?
- Server-driven HSTS: When a browser first visits a domain, the server can send a
Strict-Transport-Securityresponse header. The browser remembers this policy for the duration specified bymax-age. Any future visits within that period will use HTTPS. However, the very first visit is unprotected - this is the “first-load problem.” - Preloaded HSTS: Domains in the preload list are protected from the very first connection. The browser checks its internal list before making any connection and refuses to send HTTP traffic. No server interaction is needed to activate protection. This is the strongest form of HTTPS enforcement available.
- Getting preloaded: To be added to the list, a domain must meet strict requirements: it must have a valid TLS certificate, permanently redirect HTTP to HTTPS, and include a
Strict-Transport-Securityheader withmax-age ≥ 31,536,000(1 year),includeSubDomains, and thepreloaddirective. The domain is then submitted via hstspreload.org for review.
Understanding HSTS Preload Statuses
- Preloaded:The domain is in the browser's preload list. All subdomains are automatically upgraded to HTTPS. This is indicated by a green shield badge.
- Pending: The domain has been submitted to hstspreload.org and is waiting for review. The review process checks that the domain meets all preload requirements. This status is indicated by a yellow shield badge.
- Rejected: The domain was submitted but did not meet the preload requirements. Common reasons include insufficient max-age, missing includeSubDomains, or an HTTP endpoint that does not redirect to HTTPS. This status is indicated by a red shield badge.
- Not Preloaded: The domain is not in the preload list and has not been submitted. This is the default state for most domains. This status is indicated by a gray shield badge.
Important Considerations
Adding a domain to the HSTS preload list is a significant commitment. Because the list is hardcoded into browser source code, getting removed from the list can take months - it requires a browser update cycle. Once a domain is preloaded, the browser will refuse to connect over HTTP, even if the server stops supporting HTTPS. This means you must maintain HTTPS support for your domain indefinitely after preloading. Domain owners should only submit to the preload list after ensuring their site and all subdomains have robust, permanent HTTPS configurations. For testing and staging subdomains, consider using separate domains that are not preloaded.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About HSTS Preload
The HSTS preload list is a hardcoded list of domain names maintained by Google and shipped with Chrome, Chromium, Firefox, Safari, Edge, and Opera. When a domain is on this list, browsers automatically upgrade all HTTP connections to HTTPS before any data is sent - even on the very first visit. This eliminates the "first-load vulnerability" of standard HSTS.
Enter a domain name in the input above and click "Check". Our tool queries the official hstspreload.org API v2 and returns the status: Preloaded (in the list), Pending (under review), Rejected (did not meet requirements), or Not Preloaded. Results include detailed descriptions and a link to hstspreload.org for more information.
A "Preloaded" status means the domain is in the Chrome/Chromium HSTS preload list. Browsers will automatically upgrade all HTTP connections to HTTPS without waiting for a server response. This protection applies to the domain and all its subdomains. It is the strongest form of HTTPS enforcement available.
"Not Preloaded" means the domain is not in the HSTS preload list. Browsers will not automatically upgrade HTTP to HTTPS on the first visit. The domain may still use server-driven HSTS (via the Strict-Transport-Security header), but this only protects after the first visit. To get preloaded, visit hstspreload.org and follow the submission requirements.
To get added to the preload list, your domain must: (1) have a valid TLS certificate, (2) redirect HTTP to HTTPS permanently (301 redirect), (3) serve a Strict-Transport-Security header with max-age ≥ 31,536,000 seconds (1 year), includeSubDomains, and the preload directive. Then submit your domain at hstspreload.org. After submission, the status will show "Pending" until the review is complete.
Removal from the HSTS preload list can take months because the list is hardcoded into browser source code and is only updated with new browser releases. Once a domain is preloaded, browsers will refuse HTTP connections indefinitely. This is why it is critical to ensure your site and ALL subdomains have permanent HTTPS support before submitting to the preload list.
Yes. The requirement for preload includes the includeSubDomains directive, which means the preload entry covers all subdomains of the submitted domain. If you check a subdomain (e.g., app.example.com) and it shows as covered by its parent domain, the preloaded domain field will show the parent domain name. This is important to verify when assessing security coverage.
Yes! The HSTS Preload Checker is 100% free with no signup, no API key, and no usage limits. Check as many domains as you need, as often as you need. The tool queries the official hstspreload.org API directly from your browser - we do not store or log any domain checks on our servers.