How to use this developer tool
- Paste the labeled settings into the input.
- Keep directive names and values on the same line where shown.
- Select Build Header or press Ctrl/Cmd + Enter.
- Review warnings, then copy or download the output.
HSTS Header Builder
HSTS Header Builder processes labeled configuration values and produces a copy-ready header without sending the input to a server. It reports structural problems and deployment-sensitive combinations instead of silently normalizing them. Use the sample to see the accepted format, then replace it with the exact value from your response configuration.
Developer Input
Header settingsAd space
What this developer tool does
The result identifies the directives handled by this implementation and turns them into a readable summary. Warnings call out missing protections, malformed values, or combinations that browsers commonly reject.
Input is split into labeled lines and converted into standards-shaped directives.
This browser-side result cannot confirm how a reverse proxy, CDN, or browser will alter the final response.
Example
Input
Max-Age: 31536000 Include SubDomains: yes Preload: no
Expected result
The output lists or generates the applicable header directives and reports any rule that needs review.
Use cases
- Review response headers before deployment.
- Translate configuration requirements into a copy-ready value.
- Diagnose browser warnings during local development.
- Document the intended policy in a pull request.
Tips for reliable output
- Copy the value from the final HTTP response, not only application source.
- Test changes on a staging hostname first.
- Keep directive names exact; unknown names may be ignored.
- Recheck behavior behind a CDN or reverse proxy.
- Use browser developer tools to inspect the delivered header.
Processing details
Parsing runs entirely in JavaScript. The implementation preserves values needed for review, exposes structured JSON and CSV downloads when available, and avoids treating a successful parse as proof of correct deployment.
No live origin is contacted. Support matrices and service-side eligibility can change, so confirm high-impact settings with current platform documentation.
Frequently asked questions
What input does the HSTS Header Builder accept?
Paste the header value or the labeled settings shown in the sample. The parser ignores surrounding whitespace but reports malformed directives.
Does the HSTS Header Builder make a network request?
No. Processing stays in the browser and the tool does not contact the target origin or verify a live server configuration.
How are duplicate or conflicting directives handled?
The output lists duplicates and reports conflicts where the applicable HTTP or cookie rules make them meaningful.
Can I use the generated output in production?
Review it against your application, browser support requirements, and deployment environment before adding it to a production response.
Does this tool follow current browser behavior?
It applies the documented syntax and common deployment rules represented in the page. Browser versions and server behavior can still differ, so test the final response.
Related developer tools
Output fields
| Field | Meaning |
|---|---|
| Status | Pass, review, parsed, built, or eligibility state |
| Items checked | Number of directives, attributes, or rules processed |
| Warnings | Configuration issues requiring manual review |
HTTP & Security Headers
Browse builders, parsers, and configuration checkers for HTTP response behavior and browser security controls.
View category