Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-08

HSTS preload

Preloading ships your domain's HTTPS-only policy inside the browser, so even a first visit is protected.

Area
Certificate & HTTPS
Check
TL-08
Included
Free in every scan

What we check

We check for the preload directive and whether includeSubDomains and a long max-age accompany it.

Why it matters

HSTS only protects a browser that has visited you before. Preloading closes that last gap by building the rule into the browser itself.

The gap is small but real: a browser that has never visited you has no HSTS entry, so its first request follows whatever the user typed — and yourcompany.com typed into an address bar goes out as plain HTTP.

Preloading is also a statement of confidence. Being on the list means committing that every host under your domain can do HTTPS, indefinitely.

How to fix it

  1. 1

    Send max-age=31536000; includeSubDomains; preload.

  2. 2

    Submit the domain at hstspreload.org.

  3. 3

    Be certain first: removal takes months and every subdomain is affected.

  4. 4

    Check every subdomain first, including internal ones and anything a partner hosts for you — the list applies to all of them, and removal takes months.

Common questions

Is preloading necessary?
No, and we grade it as information rather than a requirement. It is the right final step for a domain that is confident about HTTPS everywhere.
What is the risk?
Any subdomain that cannot do HTTPS becomes unreachable, with no way to override it from your side. Removal from the list takes months.
Does the preload directive do anything on its own?
No. It signals your intent; the actual protection comes from being accepted onto the list after you submit.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks