HSTS on 27 homepages: 25 send it, and 3 of the 18 asking for preload miss the list's own rules

FIELD TEST · 2026-08-30 · 27 homepages · one http request and one https request each · Strict-Transport-Security

Sample and method: the 30-site panel this blog has used since 2026-08-15. On 2026-08-30 each homepage got two requests — one to http:// with redirects switched off, to see the first hop and nothing else, and one to https:// to read the security headers. Three sites dropped out: stackoverflow.com and medium.com answered 403, reddit.com returned 8,393 bytes and missed the 10,000-byte floor. That leaves 27.

Twenty-five of the 27 homepages send an hsts header. All 27 redirect http:// to https:// on the very first hop, though one of them does it with a 302. Eighteen ask to be on the browser preload list, and three of those eighteen send a header that does not meet the list's own published requirements.

How we measured it

Two requests per site. The http:// request used a redirect handler that returns the first response instead of following it, so the status code and Location below are the origin's own first answer, not the end of a chain. The https:// request read Strict-Transport-Security off the response as delivered.

Two caveats belong here rather than at the end. We stopped at the first hop, so a site that redirects twice looks the same here as one that redirects once. And we read today's header only — we never checked the actual preload list, so a site whose header falls short today may well already be on it from an earlier submission.

Everyone redirects http to https, in three different codes

There is no gap to report on the redirect itself. All 27 answer plain http:// with a redirect to the https address of the same host, on the first response, with no exceptions.

The 302 is worth a second look. Google's redirect documentation splits redirects into permanent and temporary, and for a temporary one says the indexing pipeline "doesn't use the redirect as a signal that the redirect target should be canonical". Moving a whole site from http to https is about as permanent as a redirect gets, so the code says one thing and the intent says another. Which one to send is 301 vs 302 redirect, and the hop counts on this same panel are in redirect chains on 30 homepages.

Three sites also put an explicit port in the target — slack.com, webflow.com and arstechnica.com all send Location: https://host:443/. It works. It is also a port number that never needed writing down.

Twenty-five hsts headers, and one that lasts five minutes

RFC 6797 defines max-age as the number of seconds after receiving the header during which the browser treats the host as a known HSTS host. That makes the value a memory span, and the spread across 25 sites is wider than the header's reputation suggests.

The five-minute one is techcrunch.com. Five minutes after a visitor's last page view, that browser is back to trying http:// first, which is most of what the header exists to prevent. Two sites send no header at all: railway.com and www.wired.com.

Nineteen of the 25 include includeSubDomains, which RFC 6797 describes as extending the policy to every subdomain of the host. github.com writes it as includeSubdomains with a lowercase d; the same RFC says directive names are case-insensitive, so that spelling is fine and only looks wrong.

max-age is not a strength setting. It is how long a browser remembers, and five minutes is a memory nobody has.

Three sites ask for preload without meeting the requirements

Eighteen headers carry the preload directive, which is a request to be baked into browsers rather than learned on first visit. The submission requirements published by the preload list itself are specific: a valid certificate, a redirect from HTTP to HTTPS on the same host, all subdomains served over HTTPS, and a header with max-age of at least 31536000 plus both includeSubDomains and preload.

None of that means these three are absent from the list. Entries submitted years ago stay in place, and a header can drift after acceptance without anything visibly breaking. What it does mean is that the header alone is not evidence of preload status, on any of the 18 sites here.

What this means for you

Three checks, in this order, and the first two are one command each.

1. Confirm your own first hop is a permanent code. curl -sI http://yourdomain/ shows the status and Location without following anything. If it is a 302, that is a temporary code doing a permanent job.
2. Read your max-age. curl -sI https://yourdomain/ | grep -i strict-transport. Anything under a year is a shorter memory than 19 of the 25 sites here give their visitors.
3. Only send preload if the rest of the header satisfies the published requirements. Sending it otherwise costs nothing and proves nothing, which is exactly the state three of these sites are in.

None of this is a ranking lever, and this survey is not the place to pretend otherwise. It affects the first request of every visit, including the first request a crawler makes, and a page an engine cannot fetch cleanly is a page it cannot quote — the part QueryWin works on.

What this run cannot tell you

Whether these 18 sites are actually on the preload list. We did not check it, so we don't know: the three rows above describe a header, not a membership. We also did not follow redirect chains past the first hop, did not test any subdomain, and did not check certificates, so the other preload requirements are simply unmeasured here. One request, one exit, one moment: a server that varies this header by region would look like a single fact.

Common questions

How did you measure this?

Two requests per homepage on 2026-08-30 — one to http:// with redirect following disabled, one to https:// — reading the first-hop status code and the Strict-Transport-Security header out of those two responses.

What does the hsts header do?

It tells a browser to use HTTPS for this host for the next max-age seconds, without trying http:// first. RFC 6797 defines the value as seconds counted from when the header arrives.

Does HSTS help SEO?

Nothing here shows that it does. Every site on this panel already redirects http to https, so the header is removing one request on the first visit, not changing what gets indexed.

How long should max-age be?

Fifteen of these 25 sites picked exactly one year, which is also the minimum the preload list requires. Below a year you are choosing a shorter memory on purpose, and 300 seconds is close to no memory at all.

Is includeSubDomains risky?

It applies the policy to every subdomain, so any subdomain still served over plain HTTP becomes unreachable for anyone who has seen the header. Six of the 25 sites here leave it off.