HSTS header parser

What this tool checks

The value is read with the same reader as the security headers check, following RFC 6797 section 6.1:

Validity: one max-age with a number of seconds and no repeated directive.
Lifetime: a max-age of zero, or shorter than one year (HSTS_SHORT_MAX_AGE).
Scope: whether includeSubDomains covers subdomains.
Preload: which of the header rules of the preload list are missing, and HSTS_PRELOAD_NOT_ELIGIBLE when the value asks for preloading without meeting them.

How to read the result

The result shows the directives as browsers read them, whether the value is valid and whether it meets the header rules for preloading. A header name such as Strict-Transport-Security: in front of the value is accepted.

Limitations

Nothing is fetched: whether a site sends the header over HTTPS and redirects HTTP to HTTPS needs a live check.
Preloading is hard to undo; read the rules on hstspreload.org before you submit a domain.

Use it from code

API reference for HSTS header parser

curl -i -X POST https://api.lookproof.dev/v1/http/hsts-parse \
  -H 'content-type: application/json' \
  -d '{"header": "max-age=63072000; includeSubDomains; preload"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Strict-Transport-Security value
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

HSTS (5)

Error HSTS_INVALID Browsers ignore this Strict-Transport-Security value.
Warning HSTS_MAX_AGE_ZERO max-age=0 tells browsers to forget the HSTS policy.
Info HSTS_NO_INCLUDE_SUBDOMAINS The HSTS policy does not cover subdomains.
Warning HSTS_PRELOAD_NOT_ELIGIBLE The value asks for preloading but does not meet the preload list's rules.
Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

Frequently asked questions

When do browsers ignore an HSTS header?

RFC 6797 requires one max-age directive with a number of seconds and forbids repeating a directive. A value that breaks either rule is ignored as a whole: HSTS_INVALID says which rule.

Is this the same as the preload check on hstspreload.org?

It checks the header rules of the preload list: a max-age of at least one year, includeSubDomains and preload. The list also needs a redirect from HTTP to HTTPS and the header on the registrable domain, which only a live check of the site can show.

What does max-age=0 do?

It tells browsers to forget the stored policy, which is the way to switch HSTS off. The tool reports it as HSTS_MAX_AGE_ZERO so it is not mistaken for a short policy.