hstspreload
Chromium HSTS Preload list as a Python package
Decision gist · record as of 2026-08-14
Yes, if you need to check HSTS Preload status in your application. The package is lightweight, dependency-free, actively maintained, and permissively licensed. Install it only if you have a specific use case for preload-list lookups; it is not a general-purpose security library.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.6 or later.
- Low friction install with no runtime dependencies.
- Actively maintained with monthly automated updates to track the upstream Chromium HSTS Preload list.
License · maintenance · safety
BSD-3 (permissive) — BSD-3 is a permissive license; you can use this package freely in commercial and open-source projects with minimal restrictions.
last release 2025-01-01 (590 days) · last repo commit 2026-08-01 · 14 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 581,131 downloads/mo, #5,909 on PyPI
Alternatives
Verify before relying
pip install hstspreload
from hstspreload import in_hsts_preload
result = in_hsts_preload('example.com')
print(result) # True or False- Whether the monthly update cycle is reliable enough for time-sensitive security decisions
- Performance characteristics when checking many hostnames in sequence
What it is and what it does
hstspreload is a Python wrapper around the Chromium HSTS Preload list, a curated registry of domains that should only be accessed over HTTPS. The package exposes a single function, `in_hsts_preload()`, that accepts an IDNA-encoded hostname and returns a boolean indicating whether that domain is on the preload list. This is useful for security-conscious applications that need to enforce HTTPS-only access for known high-value targets.
The package is maintained through an automated monthly release cycle that monitors the upstream Chromium repository for changes to the HSTS Preload list. It has no runtime dependencies, installs cleanly as a pure Python wheel, and supports Python 3.6 through 3.10. The implementation is straightforward: you install it, import the function, and call it with a hostname to get a boolean result.
Use it for
- Validate that a user-supplied domain is on the HSTS Preload list before making security decisions about connection requirements.
- Build a security audit tool that flags domains not yet on the preload list but should be.
- Enforce HTTPS-only policy in a web client or proxy by checking domains against the preload list.
- Test or document which of your organization's domains are registered in the Chromium HSTS Preload list.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to check HSTS Preload status in your application.
The package is lightweight, dependency-free, actively maintained, and permissively licensed. Install it only if you have a specific use case for preload-list lookups; it is not a general-purpose security library.
Install
hstspreload on PyPI
Before you install
Low friction install with no runtime dependencies. Actively maintained with monthly automated updates to track the upstream Chromium HSTS Preload list.
Requires Python 3.6 or later.
License in practice
BSD-3 is a permissive license; you can use this package freely in commercial and open-source projects with minimal restrictions.
Quickstart
pip install hstspreload
from hstspreload import in_hsts_preload
result = in_hsts_preload('example.com')
print(result) # True or FalseVerify before relying
- Whether the monthly update cycle is reliable enough for time-sensitive security decisions
- Performance characteristics when checking many hostnames in sequence
Package facts
| License | BSD-3 permissive |
| Python support | Supports the current Python release >=3.6 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 590 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 581,131 / month, #5,909 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: Web EnvironmentIntended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTPTopic :: Security |
Evidence: hstspreload-2025.1.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “hsts preload list lookup”
- hstspreloadProvides a single function to check whether a hostname is in the…
- SecwebSecweb applies security headers (CSP, HSTS, X-Frame-Options, and 13…
- secureApplies HTTP security headers to Python web responses through a…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also secure · Secweb · flask-talisman · backports.ssl_match_hostname · service-identity · cloakbrowser · fqdn · pyppeteer · getmac · mycdp