HSTS Checker API
Detect and analyse HTTP Strict Transport Security (HSTS) headers for any domain.
Last Updated: 01 April 2026
The Velohost HSTS Checker API provides a programmatic way to inspect HTTP Strict Transport Security (HSTS) policies for any HTTPS-enabled domain.
It performs a live HTTPS request and analyses the
Strict-Transport-Security response header.
Base API URL
All endpoints listed below are relative to this base URL.
https://api.velohost.co.uk/hsts-checker/ Rate Limiting
This API is protected by a global rate limit to ensure fair usage and platform stability.
- Limit: 30 requests per 10 seconds per IP address
- Burst traffic is allowed
- No authentication required
-
Requests exceeding the limit return
HTTP 429
This limit applies across all Velohost public APIs.
Error responses
The API uses standard HTTP status codes to indicate errors.
Returned when the global rate limit is exceeded.
{
"detail": "Rate limit exceeded"
}
Returned when the domain parameter is missing or invalid.
Endpoints
Check HSTS policy
Performs an HTTPS request to the target domain and inspects the
Strict-Transport-Security response header.
GET /lookup?domain=example.com
<lbrace>'<lbrace>'<rbrace> "domain": "example.com", "hsts_enabled": false, "max_age": null, "include_subdomains": false, "preload": false, "raw_header": null, "source": "https-response" <lbrace>'<rbrace>'<rbrace>
Implementation Guidance
For production use, validate input before sending requests, implement retry with exponential backoff on 429 or transient failures, and log normalized responses for trend monitoring.
Learn more
Explore the tool, documentation, and guides.