38

My question is about Firefox and Chrome.

Is there a possibility to see which sites have set the HSTS flag in my browser?

Improve this question
1
  • For those on MacOS, the Firefox profile directories are under: ~/Library/Application\ Support/Firefox/Profiles
    – Ajoy Bhatia
    Commented Nov 8, 2016 at 22:46

3 Answers 3

Reset to default
43

Chrome:

  • Open Chrome
  • Type chrome://net-internals/#hsts in the address bar of chrome
  • Query domain: if it appears as a result, it is HSTS-enabled

Firefox:

  • Open file explorer
  • Copy and paste the following path into the address bar of your file explorer
    • On Windows: %APPDATA%\Mozilla\Firefox\Profiles\
    • On Linux: ~/.mozilla/firefox
    • On Mac: ~/Library/Application Support/Firefox/Profiles
  • Double click the folder you see (if you have multiple Firefox profiles, there will be multiple folders)
  • Open SiteSecurityServiceState.txt. This textfile contains sites that have enabled HSTS.
Improve this answer
5
  • 1
    So, there is no list for Chrome, just the queries?
    – HorstKevin
    Commented Jul 2, 2015 at 18:28
  • 1
    Not as far as I know. You could take a look at the preloaded list: chromium.org/hsts
    – Michael
    Commented Jul 2, 2015 at 18:51
  • Yes, I know. But there are also sites which I visited which are not on the preload list.
    – HorstKevin
    Commented Jul 3, 2015 at 7:05
  • I don't recall if it was there in 2015, but since at least my oldest mothballed system (XP, yes I said XP, with Firefox 52.9 from 2018) the in-use profile directory is available in Help / Troubleshooting Information
    – dave_thompson_085
    Commented Aug 20, 2021 at 0:39
  • 2
    Firefox now uses a binary formatted file, SiteSecurityServiceState.bin so managing this with a text editor is not feasible anymore.
    – Spitfire19
    Commented Feb 23 at 16:09
5

There is a Firefox plug-in called PinPatrol that lists all sites (preloaded and visited) known to have HSTS support.

This is a Firefox extension that shows in a readable format, the state of HSTS and HPKP domains stored by the browser. Firefox does not have a native way to show these domains or this functionality documented.

Improve this answer
1
  • Firefox now uses a binary formatted file, SiteSecurityServiceState.bin and as of this writing PinPatrol does not support it.
    – Spitfire19
    Commented Feb 23 at 16:13
2

You can find the full Chrome HSTS list in the Chromium source code file transport_security_state_static.json

Firefox uses the same list.

Improve this answer
1
  • 1
    That's the preload list, and OP said in 2015 they don't want only preloads but also site dynamic settings.
    – dave_thompson_085
    Commented Aug 20, 2021 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .