HSTS Preload Auditor

Security Auditor — checks whether Strict-Transport-Security meets Chromium HSTS preload header requirements.

Security

Preload-ready HSTS locks browsers onto HTTPS for the host and all subdomains.

Compatibility

Header syntax follows RFC 6797; Chromium requires max-age ≥ 1 year, includeSubDomains, and preload.

This auditor fetches the audited HTTPS URL and inspects Strict-Transport-Security. It does not check HTTP→HTTPS redirects, certificate validity, or whether the host is already on the live Chromium preload list.

How it works

The auditor judges Chromium HSTS preload readiness from the STS header on the audited URL:

Parse — requires an https URL with a hostname. Non-HTTPS URLs skip the fetch and warn. Invalid or empty URLs error.
Fetch — reads response headers with HeadersCrawler. All Strict-Transport-Security values are collected; RFC 6797 uses the first.
Rules — missing header, missing or low max-age (below 31536000), missing includeSubDomains, and missing preload are separate FAILs. Multiple STS values are a WARNING.
Aggregate — ERROR wins, then FAIL, then WARNING; if every rule passes, the audit is SUCCESS.
Specification pin — every run emits 37A-HSTSPreloadAuditor-100 (INFORMATION) naming Chromium HSTS Preload submission requirements and RFC 6797 (2012-11), pinned to https://hstspreload.org/#submission-requirements. That check does not change overall status.

What it audits

Every row maps to one checkRule* method and one CheckCode. 37A-HSTSPreloadAuditor-100 is emitted on every run, including fetch errors and non-HTTPS URLs. Directive FAILs (401–404) are skipped when the header itself is missing (400). CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.

CheckCode	Status	When it fires	Recommendation
`37A-HSTSPreloadAuditor-100`	`INFORMATION`	Every run. Records that this auditor implements Chromium HSTS Preload submission requirements and RFC 6797 header syntax.	This auditor implements Chromium HSTS Preload submission requirements; pin `https://hstspreload.org/#submission-requirements`.
`37A-HSTSPreloadAuditor-301`	`WARNING`	The URL scheme is not `https`.	Use https:// for `{url}`; HSTS preload cannot be audited over `{scheme}`.
`37A-HSTSPreloadAuditor-300`	`WARNING`	More than one `Strict-Transport-Security` header value was returned.	Send a single Strict-Transport-Security header on `{url}`; RFC 6797 uses the first value (`{first}`).
`37A-HSTSPreloadAuditor-400`	`FAIL`	`Strict-Transport-Security` is absent or blank.	Add `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` on `{url}`.
`37A-HSTSPreloadAuditor-401`	`FAIL`	The header is present but has no usable `max-age` directive.	Add `max-age` ≥ 31536000 to `{header}` on `{url}`.
`37A-HSTSPreloadAuditor-402`	`FAIL`	`max-age` is present and below 31536000 (skipped when `401` applies).	Raise max-age on `{url}` from `{maxAge}` to at least 31536000 (header `{header}`).
`37A-HSTSPreloadAuditor-403`	`FAIL`	The header is present but does not include `includeSubDomains`.	Add includeSubDomains to the Strict-Transport-Security header on `{url}`.
`37A-HSTSPreloadAuditor-404`	`FAIL`	The header is present but does not include `preload`.	Add the preload token to the Strict-Transport-Security header on `{url}`.
`37A-HSTSPreloadAuditor-500`	`ERROR`	The URL is invalid or response headers could not be read.	Retry the audit of `{url}`; verify the URL is reachable. Last error was `{error}`.
`37A-HSTSPreloadAuditor-200`	`SUCCESS`	HTTPS response has a single preload-ready STS header. Message is `Strict-Transport-Security on "{url}" is "{header}" (max-age={maxAge}, includeSubDomains, preload).`	—

Output documentation

Status	Description	Test logic
SUCCESS	The HTTPS response sends a preload-ready STS header	First `Strict-Transport-Security` value has `max-age` ≥ 31536000, `includeSubDomains`, and `preload` (`200`).
WARNING	Preload cannot be judged, or the header is ambiguous	Scheme is not https (`301`); more than one STS value (`300`). Multiple values can appear together with FAILs when the first header is incomplete.
FAIL	The header is missing or not preload-eligible	Missing header (`400`); no usable `max-age` (`401`); `max-age` below 31536000 (`402`); missing `includeSubDomains` (`403`); missing `preload` (`404`).
ERROR	The auditor could not read headers	Empty, blank, or invalid URL; fetch failure (`500`).
INFORMATION	Specification pin	Always emitted (`100`); does not change overall status.

Risks and considerations

Preload is hard to undo

Once a host is on the Chromium preload list, browsers refuse HTTP for that host and all subdomains until a removal request is processed.
Do not add preload until every subdomain can serve HTTPS and you intend to submit the domain at hstspreload.org.

Incomplete HSTS is not preload

A header without includeSubDomains or preload, or with max-age under one year, is ordinary HSTS at best and is not eligible for the preload list.
max-age=0 signals HSTS removal and fails the preload minimum.

What this auditor does not check

Chromium also requires a valid certificate and an HTTP→HTTPS redirect on the same host. Use the Certificate and HTTP Redirect auditors for those.
STS headers sent over HTTP are ignored by RFC 6797; this auditor will not fetch a non-https URL.
Presence on the live Chromium preload list is not verified.

Auditors

MCP Server

REST API

HSTS Preload Auditor

Security

Compatibility

How it works

What it audits

Output documentation

Risks and considerations

Preload is hard to undo

Incomplete HSTS is not preload

What this auditor does not check

Security

Compatibility

​How it works

​What it audits

​Output documentation

​Risks and considerations

​Preload is hard to undo

​Incomplete HSTS is not preload

​What this auditor does not check

How it works

What it audits

Output documentation

Risks and considerations

Preload is hard to undo

Incomplete HSTS is not preload

What this auditor does not check