Detect HSTS
HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
Detection looks at response headers, url patterns across 2 fingerprint rules among the site's public responses.
01
Websites using HSTS
Loading website list…
02
Signal classes
PluginView evaluates public page signals in these classes when identifying HSTS. Individual fingerprint rule bodies are proprietary and are not published.
- Response headers
- URL patterns
03
Example public indicators for HSTS
Illustrative indicators derived from public catalog metadata for HSTS. A live scan may match additional proprietary rules beyond these examples.
- strict-transport-security
- https://.dev/./
04
What a detection means
- Establishes
- One or more public signals on the scanned page matched a known HSTS signature (2 rules) at the time of the scan.
- Does not establish
- A sitewide install of HSTS, an active vendor contract, exclusive use, or that HSTS is still in place today.
05
How to check a site for HSTS
- 1. Enter the website URL in the scan form — homepage, pricing, checkout, or login pages usually expose the strongest HSTS signals.
- 2. PluginView reads only public responses (response headers, url patterns) and scores them against the HSTS signature set (2 rules).
- 3. Review the confidence score and text explanation for HSTS on the results page.
06
FAQ: detecting HSTS
- Can PluginView detect HSTS without logging in?
- Yes. PluginView only reads publicly accessible responses when checking for HSTS — typically response headers, url patterns. It does not bypass authentication or paywalls.
- What category is HSTS?
- HSTS is classified under Security in the PluginView directory.
- How many fingerprint rules cover HSTS?
- This reference currently tracks 2 fingerprint rules across response headers, url patterns. Individual rule bodies are proprietary and are not published.
- What public signals suggest a site uses HSTS?
- Illustrative public indicators for HSTS include strict-transport-security; https://.dev/./. A live scan may match additional proprietary rules beyond these examples.
