What this checks

HSTS tells a browser your site must only ever be reached over HTTPS. It is not reversible on a schedule you control — a browser that has seen max-age=31536000 will refuse plaintext for a year, and there is no way to reach out and correct that. So this tool recommends the next step of a ramp rather than the finished header.

Read the HSTS documentation for the full walkthrough, or enter a domain above to see where it stands today.