What HSTS Preloading measures
The check tests whether your domain meets the preload requirements: a valid certificate, a redirect from HTTP to HTTPS, and a Strict-Transport-Security header with a long max age, the includeSubDomains flag and the preload flag.
How to read your result
The page lists each requirement with a pass or fail, so any failure names exactly what is missing from your header. Submission is a separate step you take once every requirement passes.
What to change first
Make sure includeSubDomains is genuinely safe before you add it. Every subdomain, including internal tools and legacy systems, must work over HTTPS, because preloading is slow and awkward to reverse.
Common questions
- Should every site preload HSTS?
- Only sites confident that every subdomain will stay on HTTPS permanently. Removal from the list takes months to reach browsers.
- What does preloading actually change?
- Browsers ship knowing your domain is HTTPS only, so even a first ever visit never sends an insecure request that could be intercepted.
Related tests
Run this alongside every other test in Website Security Checks, or start from the full list of website testing tools.