What Is HSTS and Why Does Your Website Need It?

The Problem HSTS Solves

Even after you install an SSL certificate and redirect all HTTP traffic to HTTPS, there is a window of vulnerability on the very first connection. If a user types http://yoursite.com or clicks an HTTP link, their browser sends an initial unencrypted request before the server has a chance to redirect them. A man-in-the-middle attacker on the same network can intercept and modify that first request — this is called an SSL stripping attack.

HSTS eliminates this window by instructing browsers to never make an HTTP request to your domain in the first place.

How HSTS Works

When a browser receives a response with the HSTS header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

It records the policy and, for the next max-age seconds (one year in this example), automatically upgrades all requests to your domain from HTTP to HTTPS before sending them. The HTTP request never leaves the browser.

The Preload List

For maximum protection, you can submit your domain to the HSTS preload list — a list hardcoded into Chrome, Firefox, Safari and Edge. Preloaded domains are enforced as HTTPS-only even on the very first visit, before the browser has ever seen your HSTS header.

Requirements for preload:

• Serve a valid certificate
• Redirect all HTTP to HTTPS
• Serve HSTS on all subdomains (includeSubDomains required)
• max-age of at least 31536000 (one year)
• Include the preload directive

Submit at hstspreload.org.

What Not to Do

• Do not set HSTS on a domain where you are not fully committed to HTTPS — removing it after the fact is difficult because browsers cache the policy.
• Do not use a very long max-age until you have tested HTTPS thoroughly on all subdomains.
• Start with a short max-age (e.g. 3600), verify everything works, then increase to one year.

Check whether your site's HSTS header is configured correctly with our Security Headers Checker.