HSTS preload list

The header asks to be shipped in the browsers’ own HTTPS-only list. The list wants max-age of at least a year and includeSubDomains before it will accept a domain.

• Help center

Even with HSTS, the very first visit to a site starts over plain HTTP, because the browser has not yet seen the header. The preload list closes that gap: it is a list of domains built into Chrome, Firefox, Safari and Edge, which they open only over HTTPS from the first request. A domain gets on it by sending the preload token in its HSTS header and submitting itself at hstspreload.org.

How SiteScan checks it

This row appears only when the HSTS header contains preload. The scanner then checks the list's terms that can be read from the header: max-age of at least one year (31,536,000 seconds) and includeSubDomains. If both are there, the row shows “Present”; if not, “Terms not met” in amber — the list would reject the domain, yet the header suggests otherwise. SiteScan does not query the list itself, so submitting is still up to you.

Before you preload

Preloading is optional and hard to undo: removal takes months to reach browsers. Every subdomain, including internal ones, must work over HTTPS. The full header looks like this:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

The HTTP address must also redirect to HTTPS on the same host.