What Is HSTS?
LibraryHTTP Strict Transport Security (HSTS) is a response header — `Strict-Transport-Security` — that tells browsers to connect to a domain only over HTTPS for a set period, optionally including subdomains and the browser preload list. It closes the window for downgrade and cookie-hijacking attacks on the first request and is a standard item in security audits.
Detect HSTS on any website:
Why HSTS Matters
Libraries and third-party services are where a site's real behaviour lives: analytics, payments, auth, UI components and animation all arrive as scripts the browser can see. Knowing that HSTS is on a page tells you about its dependencies, its privacy footprint, and sometimes its build pipeline — and it helps you tell template-driven stacks from hand-assembled ones. We've fingerprinted HSTS on 30 live sites in our database, so the answers here are grounded in real scan data — not marketing copy.
Does HSTS Mean a Site Was Built With AI?
HSTS alone is not an AI signal.
A security header or protection is standard web tooling used by hand-coding developers and AI tools alike. It becomes weak supporting context only in combination with other evidence — for example a shadcn/ui + Supabase + Vite bundle that matches a known AI-builder export — and never counts as proof on its own.
How this feeds the score: builder fingerprints, bundle artifacts and AI-tool traces are weighed separately from stack context like frameworks, libraries and hosting. The full breakdown is on How scores work.
How Websites Using HSTS Work
- `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` on HTTPS responses
- Set by the hosting platform (Vercel, Netlify, Cloudflare), a reverse proxy or framework middleware
- Preload submission at hstspreload.org hard-codes the policy into browsers
- Part of the site-readiness score; unrelated to authorship
Best Practices When Working With HSTS
Based on patterns in our scan dataset and the detection evidence tiers.
- →Start by running a HSTS detection scan on any URL you're evaluating — the 80+ signal engine returns a confidence score plus the exact markers it matched, which beats reading view-source by hand.
- →Cross-check the result against the full detection evidence in /how-scores-work — confidence tiers tell you whether a match is strong (headers + scripts) or circumstantial (a single HTML pattern).
How we detect HSTS — see our methodology: AI Influence Score calculation, evidence tiers, and fingerprint signal types.
How Our Detector Identifies HSTS
Our scanner analyzes multiple layers of a website's technical fingerprint to detect HSTS usage.
- HTTP response headers: strict-transport-security containing ".+" (high-confidence tier)
- Signal weights for HSTS: 95 points per high-tier match, 70 per medium, 40 per low — a site needs 60+ points before HSTS is reported.
Websites Built With HSTS
Real sites detected by our scanner
doomfan1.wordpress.com11/3/2026What HSTS Sites Usually Run Alongside
Technologies detected on the same domains as HSTS in our most recent scans. Counts are unique domains, not page views.
Frequently Asked Questions About HSTS
What is HSTS?+
HTTP Strict Transport Security (HSTS) is a response header — `Strict-Transport-Security` — that tells browsers to connect to a domain only over HTTPS for a set period, optionally including subdomains and the browser preload list. It closes the window for downgrade and cookie-hijacking attacks on the first request and is a standard item in security audits.
Does HSTS mean a website was built with AI?+
HSTS alone is not an AI signal. A security header or protection is standard web tooling used by hand-coding developers and AI tools alike. It becomes weak supporting context only in combination with other evidence — for example a shadcn/ui + Supabase + Vite bundle that matches a known AI-builder export — and never counts as proof on its own.
Why does HSTS matter?+
Libraries and third-party services are where a site's real behaviour lives: analytics, payments, auth, UI components and animation all arrive as scripts the browser can see. Knowing that HSTS is on a page tells you about its dependencies, its privacy footprint, and sometimes its build pipeline — and it helps you tell template-driven stacks from hand-assembled ones. We've fingerprinted HSTS on 30 live sites in our database, so the answers here are grounded in real scan data — not marketing copy.
How do we detect HSTS?+
Our scanner checks for these signals: HTTP response headers: strict-transport-security containing ".+" (high-confidence tier); Signal weights for HSTS: 95 points per high-tier match, 70 per medium, 40 per low — a site needs 60+ points before HSTS is reported.. Each match contributes to a confidence score, and the full evidence tiers are documented at /how-scores-work.
How many websites using HSTS are in the database?+
We've fingerprinted 30+ live sites built with HSTS across our scan dataset. The list refreshes as new scans come in.
What are the typical characteristics of a HSTS website?+
`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` on HTTPS responses. Set by the hosting platform (Vercel, Netlify, Cloudflare), a reverse proxy or framework middleware. Preload submission at hstspreload.org hard-codes the policy into browsers. Part of the site-readiness score; unrelated to authorship
Related Tools & Technologies
Other libraries and services we detect
Ready to put HSTS detection to work?
You now know what HSTS is, why it matters, how to spot it, and where the detection signals come from. The next step is using that knowledge on a real URL — yours, a competitor's, or a prospect's.