HSTS
HTTP Strict Transport Security is a response header that tells browsers to contact a site only over HTTPS for a stated period.
Updated 2 Sept 2026
In more detail
HSTS closes the gap that exists before a redirect can run: without it, the first request to http:// travels in cleartext and can be intercepted or downgraded. Once a browser has seen the header it rewrites subsequent requests to HTTPS itself and refuses to let users click through certificate warnings for that host.
Why HSTS matters
An HTTP-to-HTTPS redirect alone still leaves the initial request interceptable, which is enough for a network attacker to strip TLS or steal a session cookie. HSTS removes that window for returning visitors, and preloading removes it for first-time visitors too.
How it works
The header specifies max-age in seconds, optionally includeSubDomains and preload. The browser caches the policy for max-age and applies it to every request to that host. Submitting a domain to the browser preload list ships the policy in the browser itself, which is effective but slow to reverse — includeSubDomains must be genuinely true for every subdomain first.
Examples
- Strict-Transport-Security: max-age=31536000 — a one-year policy for the host.
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — the configuration required for preload-list submission.
How it is detected or measured
Check the header on an HTTPS response with curl -I, and confirm every subdomain serves valid HTTPS before enabling includeSubDomains.
Where this matters
- Security Headers Explained
What each HTTP security header protects against, sensible starting values, and the order to deploy them without breaking your site.
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
Related tools
Sources
- Strict-Transport-Security — MDN Web Docs
Header syntax, max-age semantics and preload considerations.