HSTS checker
HSTS (Strict-Transport-Security) tells browsers to only ever connect to your site over HTTPS. Without it, a network attacker can try to downgrade a visitor to plain HTTP. This free checker tells you whether your site sends it.
Run the check
Free, read-only, no signup. This runs a full xlogs scan and reports this issue plus anything else it finds.
What this checks
It reads your response headers and reports whether Strict-Transport-Security is present. When it is, a browser that has visited once will refuse to connect over HTTP afterward, which closes a whole class of downgrade and interception attacks.
Why it gets missed
Your host may terminate HTTPS for you, but that does not set HSTS. It is one header line, and AI-built setups almost never add it because everything works over HTTPS already in the browser bar.
See the full step-by-step fix, with a copy-paste block for your AI tool →