HSTS Preload Checker
Whether the domain is on the browser HSTS preload list.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: hstspreload.org — Chromium HSTS Preload List
About this validation
Checks whether a domain is on the browser HSTS preload list.
- Reference documentation:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live lookup against the Chromium HSTS preload list dataset. PASS means the domain (or an applicable parent) is on the list; WARNING/INFO otherwise -- absence is common and not itself a vulnerability.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What is HSTS Preload?
It's a list built into Chrome, Firefox, Safari, and Edge that tells the browser to only ever connect to a domain over HTTPS, even before the browser has seen that domain's own HSTS header once. Being on it prevents an attacker from downgrading a user's very first connection to plain HTTP.
Why does SEOTechTests check the preload list?
Chromium publishes the exact list every browser vendor ships, so checking it directly is more reliable than trying to infer preload eligibility from response headers alone.
Is HSTS Preload required for a secure website?
No. A site can be fully served over HTTPS with a correct Strict-Transport-Security header and be secure in practice without ever submitting to the preload list -- preload closes one specific first-connection edge case, it isn't the whole of transport security.
Why can a domain be secure without being preloaded?
Preloading requires an explicit submission process and, for the main entry, a long-lived commitment to HTTPS-only; many correctly configured HTTPS sites simply haven't submitted.