HSTS Explained: Strict-Transport-Security Done Right
HTTP Strict Transport Security (HSTS) is a single response header that tells browsers to only ever talk to your site over HTTPS. It closes the small but dangerous window where a first visit can be downgraded or intercepted — but if you deploy it carelessly it can also lock visitors out of your site.
The short version
Send Strict-Transport-Security once your whole site works over HTTPS. Start with a short max-age, confirm nothing breaks, then raise it to a year and add includeSubDomains. Only add preload when you are certain every current and future subdomain will always be HTTPS. Check whether your site sends it with our headers check.
What problem HSTS solves
When someone types example.com without a scheme, the browser first tries plain http://. Even if you redirect that to HTTPS, the very first request travels unencrypted. An attacker on the same network can intercept it and keep the victim on a spoofed HTTP version of your site — a technique known as SSL stripping. HSTS removes that risk: once a browser has seen the header, it silently rewrites every future request to your domain to HTTPS before a single byte leaves the device.
The header and its directives
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadThree directives do all the work:
| Directive | Meaning |
|---|---|
max-age | How long, in seconds, the browser remembers to force HTTPS. 31536000 is one year. |
includeSubDomains | Applies the rule to every subdomain, not just the exact host that sent it. |
preload | Signals you want the domain baked into browsers’ built-in HSTS list, so HTTPS is enforced even on a first-ever visit. |
The header is only honoured when it is served over a valid HTTPS connection. Browsers ignore it on plain HTTP, which is deliberate — an attacker on an unencrypted connection should not be able to set it.
Why max-age matters both ways
The max-age value is a promise the browser keeps even if you change your mind. Set it to a year and every visitor is locked to HTTPS for a year, per device, with no way for you to remotely cancel it. That is exactly what you want for protection — and exactly why you should ramp up rather than jump straight to a large value.
A safe rollout
Treat HSTS as a staircase, not a switch:
Step 1 Strict-Transport-Security: max-age=300
Step 2 Strict-Transport-Security: max-age=86400
Step 3 Strict-Transport-Security: max-age=31536000; includeSubDomains
Step 4 Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadBegin with five minutes. Confirm every page, asset and subdomain loads cleanly over HTTPS and that there are no mixed content warnings. Only then extend the lifetime. Before adding includeSubDomains, make sure every subdomain — including internal tools, staging and legacy hosts — has a working certificate, because the rule applies to all of them at once.
The preload list, and the trap
Normally a browser only enforces HSTS after it has seen the header at least once. The preload list closes even that first-visit gap by shipping a hardcoded set of HTTPS-only domains inside the browser itself. To be accepted, your header must include preload, a max-age of at least one year and includeSubDomains, and you submit the domain to the shared preload list that the major browsers draw from.
Where to set it
Send the header only on your HTTPS responses. On Apache use Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"; on Nginx use add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;. Keep your plain-HTTP listener doing nothing but a 301 to HTTPS — see redirecting HTTP to HTTPS. HSTS is one item on the wider security headers checklist; when you are done, run a scan to confirm it is live.
Frequently asked questions
Does HSTS replace my HTTP-to-HTTPS redirect?
No. You still need the redirect for the first visit and for browsers that have never seen the header. HSTS is an extra layer that removes the interception window on repeat visits.
What happens if my certificate expires while HSTS is active?
The browser will refuse to load the site and will not let users click through the certificate warning. This is by design, so keep certificate renewal automated and monitored.
Should every site use preload?
No. The plain header protects returning visitors well. Preload only helps the very first visit and is difficult to reverse, so reserve it for sites certain to stay HTTPS-only across all subdomains.
Related guides
HTTP Security Headers: The Complete Checklist
Every important HTTP security header explained, what it protects against, and a copy-paste starting configuration.
Read →HTTP Security HeadersContent Security Policy (CSP) for Beginners
How CSP stops cross-site scripting, why it is hard to get right, and a safe way to deploy your first policy.
Read →HTTP Security HeadersX-Frame-Options and Clickjacking Protection
How clickjacking attacks work and how X-Frame-Options and frame-ancestors stop your site being embedded maliciously.
Read →Check your site against this guide
Run a free ScanOpsPro scan and see how your site handles the fundamentals.
Run a free scan