Free tools
Checks a site's Strict-Transport-Security header: whether it exists, its duration (max-age), whether it covers subdomains, and whether the domain is already on the HSTS preload list used by browsers.
It tells the browser to always use HTTPS with that domain, even if the user types the URL without "https://", avoiding an initial insecure request.
Being on the browser preload list (hstspreload.org) protects even the very first visit, because the browser already knows to use HTTPS before making any connection.
Frequently asked questions
A value of at least 31536000 seconds (one year) is considered adequate to qualify for the preload list.
It is not mandatory, but it adds an extra layer of protection against downgrade attacks on the first connection.