Free HTTPS & HSTS Checker

Nginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on; # nginx 1.25.1+; on older versions use "listen 443 ssl http2;"
    server_name example.com www.example.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

Apache

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on

    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

Node.js (Express + Helmet)

import express from "express"
import helmet from "helmet"

const app = express()

app.use(
  helmet.hsts({
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  }),
)

// Redirect any HTTP request to HTTPS (when terminating TLS upstream,
// trust the proxy and check req.secure / x-forwarded-proto).
app.enable("trust proxy")
app.use((req, res, next) => {
  if (req.secure) return next()
  res.redirect(301, "https://" + req.headers.host + req.url)
})

Next.js (next.config.mjs, works on Vercel)

const nextConfig = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [
          {
            key: "Strict-Transport-Security",
            value: "max-age=31536000; includeSubDomains; preload",
          },
        ],
      },
    ]
  },
}

export default nextConfig

On Netlify, the same headers go in a public/_headers file, and most other hosts have an equivalent headers setting.