Check 19 of 54 · Web and TLS
Browsers are told always to use the secure version of your site, for long enough to matter.
Engine 1.57.0, read 25 October 2026
Is your website set up safely?
The Strict-Transport-Security header your domain sends itself, on its redirect to www as well as its page, and its lifetime, plus where plain http:// sends a visitor and the browsers' preload list. A header that only www sends warns, because browsers apply HSTS to the name that sent it, and so does one that plain http:// skips by redirecting straight to www.
Without HSTS, a visitor's first request can be intercepted before it is ever encrypted.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
The preload list is a dated copy, so a recent addition or removal can be missed.
Check 19 is one of 15 in Web and TLS. See it in its row on the scanner page, beside the rest of Web and TLS.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.