HSTS Header Generator

Build an HSTS response header locally while keeping preload enrollment and deployment requirements separate from header generation.

max-age seconds

Common duration

includeSubDomains preload token

ReadyHSTS is honored from secure HTTPS responses. The preload token alone does not submit or enroll a domain in a browser preload list.

Local analysis is not remote verification

Unless a tool explicitly has a direct-fetch action, these HTTP tools do not contact endpoints. Browser fetch cannot bypass CORS, and generated policy text does not prove how a deployed server, browser, proxy or CDN will behave.