HSTS checker
HSTS (Strict-Transport-Security) tells browsers to only ever connect to your site over HTTPS. Without it, a network attacker can try to downgrade a visitor to plain HTTP. This free checker tells you whether your site sends it.
Run the check
Free, read-only, no signup. This runs a full xlogs scan and reports this issue plus anything else it finds.
What this checks
It reads your response headers and reports whether Strict-Transport-Security is present. When it is, a browser that has visited once will refuse to connect over HTTP afterward, which closes a whole class of downgrade and interception attacks.
Why it gets missed
Some hosts add HSTS for you and some do not, so check what your live site actually sends. If it is missing, it is one header line to add.
See the full step-by-step fix, with a copy-paste block for your AI tool →