21

My question is about Firefox and Chrome.

Is there a possibility to see which sites have set the HSTS flag in my browser?

  • For those on MacOS, the Firefox profile directories are under: ~/Library/Application\ Support/Firefox/Profiles – Ajoy Bhatia Nov 8 '16 at 22:46
28

Chrome:

  • Open Chrome
  • Type chrome://net-internals/#hsts in the address bar of chrome
  • Query domain: if it appears as a result, it is HSTS-enabled

Firefox:

  • Open file explorer
  • Copy and paste %APPDATA%\Mozilla\Firefox\Profiles\ into the address bar of the file explorer (for Linux it is ~/.mozilla/firefox; for Mac, it is ~/Library/Application Support/Firefox/Profiles)
  • Double click the folder you see (if you have multiple Firefox profiles, there will be multiple folders)
  • Open SiteSecurityServiceState.txt. This textfile contains sites that have enabled HSTS.
  • 1
    So, there is no list for Chrome, just the queries? – HorstKevin Jul 2 '15 at 18:28
  • 1
    Not as far as I know. You could take a look at the preloaded list: chromium.org/hsts – Michael Jul 2 '15 at 18:51
  • Yes, I know. But there are also sites which I visited which are not on the preload list. – HorstKevin Jul 3 '15 at 7:05
4

There is a Firefox plug-in called PinPatrol that lists all sites (preloaded and visited) known to have HSTS support.

  • 2
    It is unsupported by current version of Firefox (57+ aka Firefox Quantum) – TimSparrow Dec 7 '17 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.