DE

↑ ↓ select, Enter open, Esc close

Check whether a website sends the HSTS header

harmlessSSL and certificatesalle
Adjust the values, the command updates live
user@server
curl -sI https://example.com/ | grep -i "^strict-transport-security"

Requests the headers of the HTTPS homepage and shows the HSTS directive. It tells the browser to access the domain only via HTTPS for max-age seconds. Empty output means HSTS is not active.

Note: A long max-age with includeSubDomains is practically impossible to roll back quickly. Only enable it once all subdomains reliably support HTTPS.

Also searched as

  • check if hsts is enabled
  • show strict-transport-security header
  • check hsts preload requirements

Related one-liners

All in SSL and certificates

Check the browser caching headers of a file

$curl -sI https://example.com/wp-includes/css/dist/block-library/style.min.css | grep -iE "^(cache-control|expires|etag|last-modified|age):"
harmlessnginx

Check the X-Robots-Tag header of a URL

$curl -s -o /dev/null -D - https://example.com/ | grep -i '^x-robots-tag'
harmlessSEO checks

Detect the web server and PHP version from HTTP headers

$curl -sI https://example.com/ | grep -iE "^(server|x-powered-by|via):"
harmlessnginx

Find mixed content in the HTML of an HTTPS page

$curl -s https://example.com/ | tr '\n' ' ' | grep -oiE '(src|srcset|data-src)="http://[^"]+"|<link[^>]+href="http://[^"]+"|url\(.?http://[^)]+\)' | sort -u
harmlessSEO checks

Show the HTTP response headers of a website

$curl -sSI https://example.com/
harmlessNetwork

Test http, https, www and non-www at once

$for u in http://example.com/ http://www.example.com/ https://example.com/ https://www.example.com/; do curl -s -o /dev/null -m 10 -w "%{http_code} $u -> %{redirect_url}\n" "$u"; done
harmlessSEO checks

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.