Glossary · HTTP, edge and rendering
HSTS preload list
A list compiled into browsers of hosts that must only be reached over HTTPS, so that even a first request is upgraded.
What HSTS preload list means
A list compiled into browsers of hosts that must only be reached over HTTPS, so that even a first request is upgraded. Entry requires a one-year max-age, includeSubDomains and the preload token, and removal takes months to propagate through shipped browsers, which is why sending the token without qualifying is worse than not sending it.
How CrawlCheck measures HSTS preload list
2 finding codes in the scanner read this. The share of all scans carrying each is computed from the live corpus when this page is served, not typed into it.
| Finding code | Share of scans | Guide |
|---|---|---|
HSTS_PRELOAD_INELIGIBLE | 1.9% | HSTS audit: missing header, preload ineligible, removed |
HSTS_PRELOAD_REMOVED | 0.3% | HSTS audit: missing header, preload ineligible, removed |
Every code, its rule and its current rate: the dataset page. Scan a site to see which apply to it.
Terms this definition uses
Related terms in HTTP, edge and rendering
The delivery layer between an origin and a client: proxies, caches, redirects, status codes and the headers that decide what a crawler actually received.
Origin server · Reverse proxy · CDN · Edge node · WAF · Bot score · TLS handshake · DNS resolution · DNS timeout · Connection timeout · Read timeout · Redirect chain · Redirect loop · 301 redirect · 302 redirect · 307 redirect · 308 redirect · 304 response · 404 response · 410 response · 429 response · 500 response · 502 response · 503 response · 504 response · HEAD request · GET request · Content type · MIME sniffing · Content encoding · Compression · Brotli · ETag · Last-Modified · If-None-Match · Cache hit · Cache miss · Cache key · Vary header · Stale response · Stale-while-revalidate · Edge redirect · Origin bypass · Response parity · Header parity · hreflang · canonical URL · HSTS · Content-Security-Policy · CSP nonce · edge cache · cache split · cache-buster · Cache-Control · Age header · render-blocking resource · payload text share · lazy loading · 404 and 410 status codes
Questions about HSTS preload list
What is HSTS preload list?
A list compiled into browsers of hosts that must only be reached over HTTPS, so that even a first request is upgraded.
What does HSTS preload list not show or guarantee?
A list compiled into browsers of hosts that must only be reached over HTTPS, so that even a first request is upgraded. Entry requires a one-year max-age, includeSubDomains and the preload token, and removal takes months to propagate through shipped browsers, which is why sending the token without qualifying is worse than not sending it.
How does CrawlCheck measure HSTS preload list?
Through the finding codes HSTS_PRELOAD_INELIGIBLE, HSTS_PRELOAD_REMOVED, each with a stated rule, evidence bytes and a live share of scans on the dataset page.
Which area of the glossary does HSTS preload list belong to?
HTTP, edge and rendering: The delivery layer between an origin and a client: proxies, caches, redirects, status codes and the headers that decide what a crawler actually received.
← HSTS · Content-Security-Policy →
See it in the full glossary · 668 terms across 19 areas.