{"id":15712,"date":"2026-09-06T10:29:19","date_gmt":"2026-09-06T08:29:19","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/toolbox\/hsts-preload-readiness-checker\/"},"modified":"2026-09-06T10:29:19","modified_gmt":"2026-09-06T08:29:19","slug":"hsts-preload-readiness-checker","status":"publish","type":"page","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/","title":{"rendered":"HSTS &#038; Preload Readiness Checker: the four addresses that decide it"},"content":{"rendered":"<div class=\"gtm-analyser-container\" style=\"background: var(--bg-panel, #1e1e24); padding: 25px; border-radius: 8px; border: 1px solid var(--border, #2a2a35);\">\n<p style=\"color: var(--text-secondary, #a0a0b0); margin-bottom: 20px;\">HSTS tells a browser to use https for this host from now on, and the preload list puts that instruction into the browser before the first visit. Both depend on details that are easy to get almost right: the header has to appear on the bare domain over https, carry at least a year, cover subdomains, say preload \u2014 and the first redirect from http has to stay on the same host. This check asks the four addresses that settle it.<\/p>\n<div style=\"margin-bottom: 14px;\">\n        <label for=\"hsts-domain\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Domain<\/label><br \/>\n        <input id=\"hsts-domain\" type=\"text\" value=\"lukaswojcik.com\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box; font-family: monospace;\">\n    <\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.82rem; margin-bottom: 16px;\">From this server: four HEAD requests, one per address. Redirects are not followed, no page body is downloaded, no cookies are sent, nothing is stored beyond the rate counter.<\/p>\n<p>    <button id=\"hsts-btn\" class=\"button\" style=\"background: var(--accent, #7ee787); color: var(--on-accent, #0b1114); border: none; padding: 12px 24px; border-radius: 6px; font-weight: 700; cursor: pointer;\">Check HSTS<\/button><\/p>\n<div id=\"hsts-ausgabe\" style=\"margin-top: 22px;\"><\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.8rem; margin: 24px 0 0;\">Limits worth knowing: this checks the requirements, not the list itself \u2014 whether a domain is already in the preload list can only be answered by the list. Subdomains are not enumerated either, so includeSubDomains is read as a promise, not verified against every host.<\/p>\n<\/div>\n<p><script>\n(function () {\n    'use strict';<\/p>\n<p>    const T = {\"einleitung\":\"HSTS tells a browser to use https for this host from now on, and the preload list puts that instruction into the browser before the first visit. Both depend on details that are easy to get almost right: the header has to appear on the bare domain over https, carry at least a year, cover subdomains, say preload \u2014 and the first redirect from http has to stay on the same host. This check asks the four addresses that settle it.\",\"label_domain\":\"Domain\",\"datenschutz\":\"From this server: four HEAD requests, one per address. Redirects are not followed, no page body is downloaded, no cookies are sent, nothing is stored beyond the rate counter.\",\"knopf\":\"Check HSTS\",\"laeuft\":\"Asking four addresses...\",\"grenze\":\"Limits worth knowing: this checks the requirements, not the list itself \u2014 whether a domain is already in the preload list can only be answered by the list. Subdomains are not enumerated either, so includeSubDomains is read as a promise, not verified against every host.\",\"h_proben\":\"The four addresses\",\"tabelle_hinweis\":\"Redirects are recorded, not followed. The header only counts when it arrives over https; browsers ignore Strict-Transport-Security in an http answer entirely.\",\"h_befunde\":\"Findings\",\"sp_adresse\":\"Address\",\"sp_status\":\"Status\",\"sp_ziel\":\"Redirect to\",\"sp_hsts\":\"Strict-Transport-Security\",\"art_http_apex\":\"http, bare\",\"art_http_www\":\"http, www\",\"art_https_apex\":\"https, bare\",\"art_https_www\":\"https, www\",\"zeile_domain\":\"Domain\",\"zeile_reif\":\"Preload requirements\",\"zeile_dauer\":\"Took\",\"zeile_limit\":\"Checks left this hour\",\"wert_reif\":\"all met\",\"wert_nicht_reif\":\"not all met\",\"wert_keine\":\"none\",\"wert_ja\":\"yes\",\"wert_nein\":\"no\",\"stufe_hoch\":\"High\",\"stufe_mittel\":\"Medium\",\"stufe_niedrig\":\"Low\",\"stufe_info\":\"Information\",\"stufe_gut\":\"In order\",\"keine_befunde\":\"Nothing to report.\",\"urteil_gut\":\"HTTPS is enforced properly.\",\"urteil_warnung\":\"HTTPS works, but the enforcement has gaps.\",\"urteil_kritisch\":\"The domain can still be reached over http without protection, or https does not answer at all.\",\"fehler_kein_token\":\"The check could not be started because reCAPTCHA did not load.\",\"fehler_captcha\":\"reCAPTCHA classified the request as automated. Reloading the page normally helps.\",\"fehler_zu_viele\":\"The limit of {limit} checks per hour for this address has been reached.\",\"fehler_adresse\":\"That domain cannot be used.\",\"fehler_domain\":\"That domain cannot be used.\",\"fehler_zaehler\":\"The rate counter is unavailable, so nothing was checked.\",\"fehler_pruefdienst\":\"The reCAPTCHA service could not be reached.\",\"fehler_aufbau\":\"The service is not configured correctly. The fault is on this side.\",\"fehler_eingabe\":\"The request could not be read.\",\"fehler_methode\":\"Wrong request method.\",\"fehler_netz\":\"The service could not be reached.\",\"fehler_antwort\":\"The answer could not be read.\",\"fehler_unbekannt\":\"Something went wrong that has no message of its own.\",\"grund_leer\":\"Nothing was entered.\",\"grund_zu_lang\":\"The input is too long.\",\"grund_unlesbar\":\"It does not parse as a domain name.\",\"grund_kein_punkt\":\"The domain needs at least one dot.\",\"grund_hostform\":\"A domain name is expected, not an IP address.\",\"befund_kein_https\":\"The bare domain does not answer over https || Reason: {grund}. Everything else depends on this: without an https answer on the bare name there is nothing to enforce and nothing to preload.\",\"befund_http_stumm\":\"The bare domain does not answer over http || Reason: {grund}. Not a defect in itself \u2014 a server that refuses port 80 cannot be reached unprotected either. For the preload list, though, an http answer that redirects is required.\",\"befund_umleitung_richtig\":\"http on the bare domain redirects to https on the same host || Status {status} to {ziel}. That is exactly the first hop the preload list requires.\",\"befund_umleitung_nicht_dauerhaft\":\"The redirect uses status {status} instead of 301 || It works, but a permanent move deserves a permanent code, and some crawlers treat the difference as meaningful.\",\"befund_umleitung_bleibt_http\":\"http redirects to another http address || Target: {ziel}. The connection stays unencrypted through the second hop, which is the one an attacker on the same network needs.\",\"befund_umleitung_wechselt_host\":\"http on the bare domain jumps straight to another host || Target: {ziel}, expected first: {erwartet}. This is the single most common reason a preload submission is rejected. The first hop has to reach https on the same name; only the second may change the host.\",\"befund_umleitung_unlesbar\":\"The redirect target cannot be read || Location: {ort}\",\"befund_http_liefert_inhalt\":\"http answers with 200 instead of redirecting || The site is fully available unencrypted. Anything sent over that connection can be read and changed on the way, and search engines may index the http version alongside the https one.\",\"befund_http_unerwartet\":\"http answers with status {status} || Neither content nor a redirect. Whatever the reason, it is not the answer the preload list expects.\",\"befund_www_umleitung_bleibt_http\":\"http on www redirects to another http address || Target: {ziel}\",\"befund_www_http_liefert_inhalt\":\"www answers over http with 200 || The www host is available unencrypted, even if the bare name is not.\",\"befund_hsts_ueber_http\":\"The http answer carries a Strict-Transport-Security header || Browsers ignore it there completely. It costs nothing and protects nothing.\",\"befund_hsts_fehlt\":\"No Strict-Transport-Security header || Without it, the first request of every visit goes over http and can be intercepted before the redirect happens. The header is what closes that window for every later visit.\",\"befund_hsts_nur_auf_www\":\"The header is only on www, not on the bare domain || The bare name is what a visitor types and what the preload list looks at. A header that only appears after the redirect arrives too late.\",\"befund_hsts_vorhanden\":\"Header found: {roh} || That is the value as delivered.\",\"befund_max_age_fehlt\":\"The header carries no max-age || Without it the header has no effect at all; max-age is the only mandatory part.\",\"befund_max_age_kurz\":\"max-age is {wert} seconds ({tage} days) || The preload list requires at least one year. A shorter value still protects returning visitors for that period, so it is a sensible step while testing.\",\"befund_max_age_gut\":\"max-age covers {tage} days || At or above the one year the preload list requires.\",\"befund_ohne_includesubdomains\":\"The header lacks includeSubDomains || Every subdomain then stays reachable over http, including ones nobody remembers. The preload list requires it, and it is the part most likely to break something: any subdomain without a valid certificate becomes unreachable.\",\"befund_mit_includesubdomains\":\"The header carries includeSubDomains || Every subdomain is covered.\",\"befund_ohne_preload_kennzeichen\":\"The header lacks the preload keyword || The keyword is the operator\\u0027s consent to inclusion. Without it a submission is refused, even when everything else is in order.\",\"befund_mit_preload_kennzeichen\":\"The header carries the preload keyword || Consent to inclusion is declared.\",\"befund_preload_reif\":\"All requirements for the preload list are met || {domain} redirects correctly and sends a header with a year, includeSubDomains and preload. Whether the domain is already in the list is a separate question this check cannot answer.\",\"befund_preload_nicht_reif\":\"Not all preload requirements are met || The findings above list what is missing. HSTS itself may still be working \u2014 the list is stricter than the header.\",\"befund_preload_versprochen_nicht_erfuellt\":\"The header says preload, but the requirements are not met || Browsers ignore the mismatch, so nothing breaks. A submission would be rejected, and the keyword suggests a protection that is not in place.\",\"befund_www_ohne_hsts\":\"The www host sends no HSTS header of its own || With includeSubDomains on the bare domain it is covered anyway. Without it, www stays unprotected.\"};<\/p>\n<p>    var ENDPUNKT = '\/lw-hstscheck.php';\n    var SITEKEY = '6LcrPkEtAAAAAPo1QCOf-IIM2fCL0UfdJz4y2iSY';\n    var STUFEN = ['hoch', 'mittel', 'niedrig', 'info', 'gut'];<\/p>\n<p>    function liste(w) { return Array.isArray(w) ? w : []; }\n    function zahl(w) { return (typeof w === 'number' && isFinite(w)) ? w : null; }\n    function zeichen(w) { return (typeof w === 'string' && w !== '') ? w : null; }\n    function text(schluessel, daten) {\n        var t = T[schluessel];\n        if (typeof t !== 'string') { return null; }\n        return t.replace(\/\\{([a-z_0-9]+)\\}\/g, function (m, k) {\n            var w = (daten && daten[k] !== undefined && daten[k] !== null) ? daten[k] : null;\n            if (w === null) { return m; }\n            if (k === 'art' && T['art_' + w]) { return T['art_' + w]; }\n            return String(w);\n        });\n    }<\/p>\n<p>    function bewerten(antwort) {\n        var a = antwort || {};\n        if (a.fehler) { return { fehler: String(a.fehler), grund: a.grund || null, limit: zahl(a.limit) }; }\n        var befunde = liste(a.befunde).map(function (f) {\n            return { key: String(f.key || ''), stufe: STUFEN.indexOf(f.stufe) === -1 ? 'info' : f.stufe, daten: (f.daten && typeof f.daten === 'object') ? f.daten : {} };\n        });\n        var gruppen = {};\n        STUFEN.forEach(function (s) { gruppen[s] = befunde.filter(function (f) { return f.stufe === s; }); });\n        var proben = liste(a.proben).map(function (z) {\n            return { art: String(z.art || ''), url: String(z.url || ''), status: zahl(z.status),\n                ort: zeichen(z.ort), hsts: zeichen(z.hsts), maxAge: zahl(z.max_age) };\n        });\n        return {\n            fehler: null, domain: String(a.domain || ''),\n            urteil: (a.urteil === 'gut' || a.urteil === 'warnung' || a.urteil === 'kritisch') ? a.urteil : 'kritisch',\n            reif: a.reif === true, proben: proben,\n            befunde: befunde, gruppen: gruppen, dauer: zahl(a.dauer_ms), limitRest: zahl(a.limit_rest)\n        };\n    }<\/p>\n<p>    function skriptLaden() {\n        return new Promise(function (auf) {\n            if (window.grecaptcha) { auf(true); return; }\n            var s = document.createElement('script');\n            s.src = 'https:\/\/www.google.com\/recaptcha\/api.js?render=' + SITEKEY;\n            s.onload = function () { auf(true); }; s.onerror = function () { auf(false); };\n            document.head.appendChild(s);\n            setTimeout(function () { auf(!!window.grecaptcha); }, 8000);\n        });\n    }\n    function tokenHolen() {\n        return skriptLaden().then(function (da) {\n            if (!da || !window.grecaptcha || !window.grecaptcha.ready) { return null; }\n            return new Promise(function (auf) {\n                var fertig = false;\n                function einmal(w) { if (!fertig) { fertig = true; auf(w); } }\n                setTimeout(function () { einmal(null); }, 12000);\n                try {\n                    window.grecaptcha.ready(function () {\n                        if (fertig) { return; }\n                        if (!window.grecaptcha.execute) { einmal(null); return; }\n                        window.grecaptcha.execute(SITEKEY, { action: 'hstscheck' }).then(function (t) { einmal(t || null); }, function () { einmal(null); });\n                    });\n                } catch (e) { einmal(null); }\n            });\n        }, function () { return null; });\n    }\n    function abfragen(domain) {\n        return tokenHolen().then(function (token) {\n            return fetch(ENDPUNKT, { method: 'POST', headers: { 'Content-Type': 'application\/json' }, body: JSON.stringify({ domain: domain, token: token || '' }) })\n                .then(function (r) { return r.json().then(function (j) { return j; }, function () { return { fehler: 'antwort' }; }); }, function () { return { fehler: 'netz' }; });\n        });\n    }<\/p>\n<p>    window.LW_TEST = window.LW_TEST || {};\n    window.LW_TEST.HSTS = { bewerten: bewerten, darstellen: null, text: text, ENDPUNKT: ENDPUNKT, STUFEN: STUFEN, T: T };<\/p>\n<p>    var btn = document.getElementById('hsts-btn');\n    var out = document.getElementById('hsts-ausgabe');\n    if (!btn || !out) { return; }<\/p>\n<p>    function el(tag, stil, txt) { var e = document.createElement(tag); if (stil) { e.setAttribute('style', stil); } if (txt !== undefined && txt !== null) { e.textContent = txt; } return e; }\n    function wert(id) { var e = document.getElementById(id); return e ? e.value : ''; }\n    var UEBERSCHRIFT = 'font-family: \"Nunito Sans\", sans-serif; font-weight: 700; color: var(--text-primary, #e8e8ee); font-size: 0.95rem; margin: 22px 0 8px;';\n    var ZELLE = 'padding: 5px 12px 5px 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem;';\n    var ZELLE_WERT = 'padding: 5px 12px 5px 0; color: var(--text-primary, #e8e8ee); font-size: 0.87rem; font-family: monospace; word-break: break-all;';\n    var KASTEN = 'background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); border-radius: 8px; padding: 14px 16px; margin: 0 0 10px;';\n    var GUT = ' color: #7ee787;', WARN = ' color: #ffa94d;', ROT = ' color: #ff7b72;', GRAU = ' color: #8a8a99;';\n    var FARBEN = { hoch: '#ff7b72', mittel: '#ffa94d', niedrig: '#e3b341', info: '#8a8a99', gut: '#7ee787' };\n    var URTEIL = { gut: GUT, warnung: WARN, kritisch: ROT };\n    function gitter(sp) { return el('div', 'display: grid; grid-template-columns: ' + sp + '; gap: 0 18px; align-items: baseline;'); }\n    function paar(g, n, w, stil) { g.appendChild(el('div', ZELLE, n)); g.appendChild(el('div', ZELLE_WERT + (stil || ''), w)); }<\/p>\n<p>    function tabelle(b) {\n        var huelle = el('div', 'overflow-x: auto; margin: 0 0 6px;');\n        var t = el('table', 'border-collapse: collapse; width: 100%; min-width: 640px; font-size: 0.84rem;');\n        var kopf = el('tr', '');\n        [T.sp_adresse, T.sp_status, T.sp_ziel, T.sp_hsts].forEach(function (n) {\n            kopf.appendChild(el('th', 'text-align: left; padding: 6px 12px 6px 0; color: #8a8a99; font-weight: 700; font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.4px; border-bottom: 1px solid var(--border, #2a2a35); white-space: nowrap;', n));\n        });\n        t.appendChild(kopf);\n        b.proben.forEach(function (z) {\n            var r = el('tr', '');\n            function zelle(txt, stil) { r.appendChild(el('td', 'padding: 7px 12px 7px 0; border-bottom: 1px solid var(--border, #2a2a35); font-family: monospace; color: var(--text-primary, #e8e8ee);' + (stil || ''), txt)); }\n            zelle(T['art_' + z.art] || z.art);\n            zelle(z.status !== null ? String(z.status) : T.wert_keine, (z.status === 200 || (z.status >= 300 && z.status < 400)) ? GRAU : ROT);\n            zelle(z.ort ? String(z.ort).replace(\/^https?:\\\/\\\/\/, '') : '-', GRAU);\n            zelle(z.hsts || '-', z.hsts ? GUT : GRAU);\n            t.appendChild(r);\n        });\n        huelle.appendChild(t);\n        return huelle;\n    }\n\n    function darstellen(b, ziel) {\n        ziel.innerHTML = '';\n        if (b.fehler) {\n            var txt = T['fehler_' + b.fehler] || T.fehler_unbekannt;\n            if (b.grund &#038;&#038; T['grund_' + b.grund]) { txt = txt + ' ' + T['grund_' + b.grund]; }\n            if (b.limit !== null) { txt = txt.replace('{limit}', String(b.limit)); }\n            ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0;', txt));\n            return;\n        }\n        ziel.appendChild(el('div', 'font-size: 1.05rem; font-weight: 700; margin: 0 0 12px;' + URTEIL[b.urteil], T['urteil_' + b.urteil]));\n\n        var g = gitter('auto auto');\n        paar(g, T.zeile_domain, b.domain, GRAU);\n        paar(g, T.zeile_reif, b.reif ? T.wert_reif : T.wert_nicht_reif, b.reif ? GUT : WARN);\n        if (b.dauer !== null) { paar(g, T.zeile_dauer, b.dauer + ' ms', GRAU); }\n        if (b.limitRest !== null) { paar(g, T.zeile_limit, String(b.limitRest), GRAU); }\n        ziel.appendChild(g);\n\n        if (b.proben.length) {\n            ziel.appendChild(el('div', UEBERSCHRIFT, T.h_proben));\n            ziel.appendChild(tabelle(b));\n            ziel.appendChild(el('p', ZELLE + ' margin: 0 0 6px; font-size: 0.8rem;', T.tabelle_hinweis));\n        }\n\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_befunde));\n        var irgendwas = false;\n        STUFEN.forEach(function (s) {\n            var gr = b.gruppen[s];\n            if (!gr.length) { return; }\n            irgendwas = true;\n            ziel.appendChild(el('div', 'font-weight: 700; font-size: 0.82rem; text-transform: uppercase; letter-spacing: 0.5px; margin: 14px 0 6px; color: ' + FARBEN[s] + ';', T['stufe_' + s] + ' (' + gr.length + ')'));\n            gr.forEach(function (f) {\n                var k = el('div', KASTEN + ' border-left: 3px solid ' + FARBEN[s] + ';');\n                var t = text('befund_' + f.key, f.daten) || f.key;\n                var teile = t.split(' || ');\n                k.appendChild(el('div', 'color: var(--text-primary, #e8e8ee); font-size: 0.9rem; font-weight: 700;', teile[0]));\n                if (teile[1]) { k.appendChild(el('div', ZELLE + ' padding: 6px 0 0; line-height: 1.55;', teile[1])); }\n                ziel.appendChild(k);\n            });\n        });\n        if (!irgendwas) { ziel.appendChild(el('p', ZELLE + ' margin: 0;', T.keine_befunde)); }\n    }\n    window.LW_TEST.HSTS.darstellen = darstellen;\n\n    var laeuft = false;\n    btn.addEventListener('click', function () {\n        if (laeuft) { return; }\n        laeuft = true; btn.disabled = true;\n        out.innerHTML = '';\n        out.appendChild(el('p', ZELLE + GRAU + ' margin: 0;', T.laeuft));\n        abfragen(wert('hsts-domain')).then(function (a) { darstellen(bewerten(a), out); laeuft = false; btn.disabled = false; },\n            function () { darstellen(bewerten({ fehler: 'netz' }), out); laeuft = false; btn.disabled = false; });\n    });\n})();\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Looks at http and https, each with and without www, and reads only the status line, the redirect target and the Strict-Transport-Security header. Redirects are deliberately not followed, because the first hop is what decides: a jump straight from http:\/\/example.com to https:\/\/www.example.com disqualifies a domain from the preload list, and it is the most common reason submissions are rejected.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":38,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-tool-base.php","meta":{"footnotes":""},"tags":[91279,92769,92757],"class_list":["post-15712","page","type-page","status-publish","hentry","tag-prywatnosc-danych-pl","tag-it-networks","tag-web-development"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>HSTS &amp; Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HSTS &amp; Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Looks at http and https, each with and without www, and reads only the status line, the redirect target and the Strict-Transport-Security header. Redirects are deliberately not followed, because the first hop is what decides: a jump straight from http:\/\/example.com to https:\/\/www.example.com disqualifies a domain from the preload list, and it is the most common reason submissions are rejected.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/hsts-preload-readiness-checker\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/hsts-preload-readiness-checker\\\/\",\"name\":\"HSTS & Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-09-06T08:29:19+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/hsts-preload-readiness-checker\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/hsts-preload-readiness-checker\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/hsts-preload-readiness-checker\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Toolbox\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"HSTS &#038; Preload Readiness Checker: the four addresses that decide it\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HSTS & Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/","og_locale":"en_US","og_type":"article","og_title":"HSTS & Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog","og_description":"Looks at http and https, each with and without www, and reads only the status line, the redirect target and the Strict-Transport-Security header. Redirects are deliberately not followed, because the first hop is what decides: a jump straight from http:\/\/example.com to https:\/\/www.example.com disqualifies a domain from the preload list, and it is the most common reason submissions are rejected.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/","og_site_name":"Lukas Wojcik - Blog","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/","name":"HSTS & Preload Readiness Checker: the four addresses that decide it - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"datePublished":"2026-09-06T08:29:19+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/hsts-preload-readiness-checker\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Toolbox","item":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/"},{"@type":"ListItem","position":3,"name":"HSTS &#038; Preload Readiness Checker: the four addresses that decide it"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/15712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=15712"}],"version-history":[{"count":0,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/15712\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/38"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=15712"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=15712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}