hstspreload

What it is and what it does

hstspreload is a Python wrapper around the Chromium HSTS Preload list, a curated registry of domains that should only be accessed over HTTPS. The package exposes a single function, `in_hsts_preload()`, that accepts an IDNA-encoded hostname and returns a boolean indicating whether that domain is on the preload list. This is useful for security-conscious applications that need to enforce HTTPS-only access for known high-value targets.

The package is maintained through an automated monthly release cycle that monitors the upstream Chromium repository for changes to the HSTS Preload list. It has no runtime dependencies, installs cleanly as a pure Python wheel, and supports Python 3.6 through 3.10. The implementation is straightforward: you install it, import the function, and call it with a hostname to get a boolean result.

Use it for:

• Validate that a user-supplied domain is on the HSTS Preload list before making security decisions about connection requirements.
• Build a security audit tool that flags domains not yet on the preload list but should be.
• Enforce HTTPS-only policy in a web client or proxy by checking domains against the preload list.
• Test or document which of your organization's domains are registered in the Chromium HSTS Preload list.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a single function to check whether a hostname is in the Chromium HSTS Preload list, returning True if the host should only be accessed via HTTPS.

Yes, if you need to check HSTS Preload status in your application. The package is lightweight, dependency-free, actively maintained, and permissively licensed. Install it only if you have a specific use case for preload-list lookups; it is not a general-purpose security library.

Install

hstspreload on PyPI

pip install hstspreload

uv add hstspreload

poetry add hstspreload

Installing hstspreload

Before you install

Low friction install with no runtime dependencies. Actively maintained with monthly automated updates to track the upstream Chromium HSTS Preload list.

License in practice

BSD-3 is a permissive license; you can use this package freely in commercial and open-source projects with minimal restrictions.

Quickstart

pip install hstspreload

from hstspreload import in_hsts_preload

result = in_hsts_preload('example.com')
print(result)  # True or False

Requires Python 3.6 or later.

Verify before relying

• Whether the monthly update cycle is reliable enough for time-sensitive security decisions
• Performance characteristics when checking many hostnames in sequence

Package facts

Evidence: hstspreload-2025.1.1-py3-none-any.whl

Tags

More WWW/HTTP packages