HSTS Preload Header Generator

HSTS Preload Header Generator

Build a correct Strict-Transport-Security header in seconds. Toggle max-age, includeSubDomainset preload, then copy a ready-to-paste header value and matching server config. A live eligibility checklist tells you whether your header meets the rules for the browser preload list at hstspreload.org.

Comment utiliser

1. Choisissez un max-age duration, or choose Custom to enter your own value in seconds.
2. Activer includeSubDomains if every subdomain is served over HTTPS.
3. Activer preload if you intend to submit the domain to the browser preload list.
4. Copy the generated header, or grab a snippet for Nginx, Apache, Caddy, Express.js, or IIS.
5. Check the eligibility panel before submitting at hstspreload.org.

Caractéristiques

• Instant header generation – Updates as you toggle directives, no button to press.
• Preload eligibility checklist – Validates the 1-year minimum max-age plus includeSubDomains and preload directives.
• max-age presets – 1 year, 2 years, 6 months, and a testing value, plus a custom field.
• Server config snippets – Nginx, Apache, Caddy, Express.js, and IIS, kept in sync with your directives.
• Boutons Copier – One-click copy for both the header value and each server snippet.
• Built-in explainer – Plain-language notes on how HSTS and preloading protect users.