HTTPS
Read Strict-Transport-Security from one public response and see whether the header is long enough, covers subdomains, and matches the preload directives.
The same request also carries CSP, framing, and the other policies. Read those on the security headers checker.
HSTS, short for HTTP Strict Transport Security, is a response header that tells a browser to use HTTPS for a host and to keep doing that until a timer runs out. The header is Strict-Transport-Security. The important pieces are max-age, counted in seconds, the optional includeSubDomains flag, and the optional preload flag. After a browser has seen a valid header on an HTTPS response, it rewrites later HTTP attempts to HTTPS by itself and refuses to click through a certificate warning for that host.
The first visit is the gap. If someone types the bare name, or follows an old http link, the browser has not seen the header yet. An attacker on that network can still intercept that first request. The preload list is a list of hosts baked into the browser so that even the first visit is forced to HTTPS. Getting on that list is a one-way decision for a long time. This page shows whether the header you are serving has the shape the list requires. It does not submit the domain anywhere.
The check is the same request as the security header checker: one GET, ports 80 and 443 only, at most five redirects, and no request at all if the name resolves to a private or reserved address. The result puts the HSTS header first. max-age=0 means the site is asking browsers to forget HSTS. A missing max-age means the header is ignored. A max-age under one year, or a header without includeSubDomains, is real protection for this host and it is not preload-shaped.
Preload directives, from this response alone, are max-age of at least 31536000, includeSubDomains, and the word preload. The preload list also requires the registrable domain rather than only a subdomain, HTTPS with a trusted certificate, and an HTTP response that redirects to HTTPS and itself carries the header once you are on HTTPS. A single HTTPS response cannot prove the redirect or the rest of the zone. When the final URL is HTTP, browsers ignore the header entirely, and the result says that even if the tokens look right.
A sensible order is to redirect every HTTP URL to HTTPS, serve a year-long header with includeSubDomains on the apex and on www, watch for broken subdomains, and only then add preload. Removing a preloaded host is a browser-release problem, not a DNS change. The other headers from the same response are summarized under the HSTS block, and the full reading is on the security header page.
No. It only reads the header. Joining the list is a separate step you take at the browser vendors' site after you are sure every name under the domain can do HTTPS.
31536000 seconds, one year, is the floor for preload and a reasonable production value. Two years is common. A few minutes is only useful for a short test.
It applies the pin to every name under the host. A forgotten staging name that only has an internal certificate will fail in browsers that have seen the header.
The final URL after redirects was HTTP, or you asked for HTTP and the site did not redirect. Browsers store HSTS only from an HTTPS response.
No. The URL and the header values are used to build this answer and are not written to a log or a database.