What Is the HSTS Preload List and How Do You Get On It?

What the Preload List Is

Normally, HSTS requires a user to visit your site at least once over HTTPS before the browser enforces HTTPS-only connections. The HSTS preload list eliminates this initial vulnerability — browsers ship with a built-in list of domains that must always be accessed over HTTPS, even before any previous visit.

Chrome, Firefox, Safari, Edge and Opera all include this list. It is maintained at hstspreload.org.

Preload Requirements

Your domain must satisfy all of these:

1. Valid HTTPS certificate — no certificate errors
2. HTTP redirects to HTTPS — all HTTP requests must redirect to HTTPS
3. Serve HSTS on all subdomains: `` Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ``
4. max-age must be at least 31,536,000 (1 year)
5. includeSubDomains must be present
6. preload must be present

What to Consider Before Submitting

Preloading is a long-term commitment:

• All subdomains must support HTTPS permanently
• Removal from the list is slow (can take months to propagate)
• If you need to revert to HTTP on any subdomain, you must remove from the list first and wait

Do not preload if:

• Any subdomain needs to serve HTTP content
• You are not certain all subdomains will have valid certificates long-term
• You are testing or developing

Submitting

1. Verify your HSTS header meets requirements
2. Go to hstspreload.org
3. Enter your domain and submit

Check whether your HSTS header is correctly configured with our Security Headers Checker.