HSTS preload list requirements (tested)

The HSTS preload list is a list of domains compiled into Chrome, Firefox, Safari and Edge that are only ever loaded over HTTPS, even on the very first visit. We queried the official checker for real domains and watched Chromium upgrade a preloaded domain before it touched the network.

1. The submission requirements (from hstspreload.org)

These rules are hstspreload.org's published requirements, not our test results. To be accepted, the domain must:

serve a valid certificate;
redirect http:// to https:// on the same host first (http://example.com to https://example.com, only then to www) if it listens on port 80;
serve all subdomains over HTTPS, including www if it exists in DNS;
send this header on the base domain over HTTPS: max-age of at least 31536000 (one year), the includeSubDomains directive and the preload directive; the header on an HTTPS redirect must include them too.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Only the registrable domain (e.g. example.com) can be submitted, not a subdomain. Setting the header in nginx, including the add_header ... always and nested-location traps we measured, is covered in Strict-Transport-Security not set in nginx.

2. What the official checker returned

We called https://hstspreload.org/api/v2/status?domain=... and /api/v2/preloadable?domain=...:

Domain	Header we saw (curl)	status	preloadable errors
github.com	`max-age=31536000; includeSubdomains; preload`	`preloaded`	none
wikipedia.org	`max-age=106384710; includeSubDomains; preload`	`preloaded`	(not checked)
cloudflare.com	`max-age=15780000; includeSubDomains`	`preloaded`	`header.preloadable.preload.missing`, `header.preloadable.max_age.below_1_year`, `redirects.http.www_first`
google.com	none on the apex	`unknown`	`response.no_header`, `redirects.http.www_first`
example.com	none	`unknown`	`response.no_header`, `redirects.http.no_redirect`
unregistered domain	-	`unknown`	`domain.tls.cannot_connect`

Two things stand out. redirects.http.www_first is the most common real-world failure: the checker's message says http://google.com "should immediately redirect to https://google.com (HTTPS) before adding the www subdomain", so the browser records HSTS for the apex. And cloudflare.com is still preloaded although it would fail a new submission today: the checker validates new submissions, and an existing entry is not removed just because the header changed.

3. What the browser did (observed)

In a fresh Chromium 153 profile (no prior visits, so no dynamic HSTS), CDP Network.requestWillBeSent events showed:

Typed URL	First hop
`http://github.com/`	307 Internal Redirect, `Non-Authoritative-Reason: HSTS`, to `https://github.com/`, no remote IP (never hit the network)
`http://web.dev/` (the whole `.dev` TLD is preloaded)	same 307 Internal Redirect, reason HSTS
`http://example.com/`	sent over plain http to the server, no upgrade

That is the point of preloading: the first visit is protected too. With HSTS from the header alone, the very first http:// request still goes out in clear text before the browser learns the policy. In DevTools the same upgrade shows as a 307 Internal Redirect row.

4. Removal is slow (as documented by hstspreload.org)

hstspreload.org states that removal can take months to reach users and cannot be guaranteed for every browser, and that you should only submit if you are sure every subdomain will support HTTPS long term. To request removal: drop preload from the header, then use the removal form on hstspreload.org. Until users get a browser update, every subdomain (intranet hosts, printers, dev boxes with self-signed certs) must keep serving valid HTTPS, because browsers will refuse plain http with no click-through. Lower max-age does not help users whose browser ships the preload list.

5. Checklist before you submit

# 1. apex http must go to https on the SAME host first
curl -sI http://example.com/ | grep -i '^location'      # expect https://example.com/
# 2. header on the apex over https
curl -sI https://example.com/ | grep -i strict-transport
# 3. official check (errors[] must be empty)
curl -s 'https://hstspreload.org/api/v2/preloadable?domain=example.com'
curl -s 'https://hstspreload.org/api/v2/status?domain=example.com'

Roll out in steps: max-age=300; includeSubDomains, then a week, then a month, and only then two years plus preload. Related: HSTS in nginx.

Frequently asked questions

What are the HSTS preload requirements?

Per hstspreload.org: a valid certificate, http redirecting to https on the same host first, all subdomains on HTTPS, and a header on the apex with max-age of at least 31536000, includeSubDomains and preload.

What does redirects.http.www_first mean?

http://yourdomain redirects straight to www (http or https) instead of to https://yourdomain first. google.com and cloudflare.com both returned it from the hstspreload.org API in our check.

How do I check if a domain is on the HSTS preload list?

Query https://hstspreload.org/api/v2/status?domain=example.com. github.com and wikipedia.org returned status preloaded; example.com returned unknown.

How long does removal from the HSTS preload list take?

hstspreload.org documents that removal takes months to reach users through browser updates and is not guaranteed for all browsers. Remove the preload directive, then submit the removal form.

How can I tell a browser used the preload list?

In Chromium 153 a fresh profile loading http://github.com/ showed a 307 Internal Redirect with Non-Authoritative-Reason: HSTS before any network request; http://example.com/ was sent over plain http.

Written with AI assistance. Checked on 2026-10-01: the public hstspreload.org API (/api/v2/status and /api/v2/preloadable) queried for github.com, wikipedia.org, cloudflare.com, google.com, example.com and an unregistered domain, plus headless Chromium 153.0.8010.12 (Playwright, fresh profile, CDP Network events) loading http:// URLs. The submission rules are quoted from hstspreload.org, not invented by us; the error codes and browser behaviour are what we observed. PlainHeaders is our extension; hstspreload.org and curl are free.