What is HSTS?

HTTP Strict Transport Security (HSTS) is an HTTP response header that instructs browsers to connect to a website over HTTPS only — never plain HTTP — for a specified period. Once a browser has seen the HSTS header, it will automatically upgrade any HTTP requests to HTTPS and refuse to load the site if a valid certificate cannot be presented.

The Problem HSTS Solves

Even if a site redirects all HTTP traffic to HTTPS, there is a window of vulnerability on the very first request. If a user types example.com into their browser (no scheme), the browser tries http://example.com first. On a hostile network — a public Wi-Fi access point, for instance — an attacker can intercept that initial HTTP request, respond as if they are the server, and establish a man-in-the-middle position before the redirect to HTTPS happens. This is called an SSL stripping attack.

HSTS prevents this by telling the browser: "The next time you visit this site, go straight to HTTPS without making an HTTP request at all."

The HSTS Header

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Directive	What it does
max-age	How many seconds the browser should remember the HSTS policy. 31536000 = one year. Required.
includeSubDomains	Applies the policy to all subdomains of the current domain. Optional but strongly recommended.
preload	Signals intent to be included in browser HSTS preload lists. Optional. See below.

How HSTS Works in Practice

1. A visitor connects to your site over HTTPS for the first time. Your server returns the HSTS header.
2. The browser stores the HSTS policy: "for the next 365 days, always use HTTPS for this domain."
3. When the same visitor types your domain into the address bar, the browser upgrades the connection to HTTPS internally before any network request is made — no HTTP connection ever leaves the device.
4. If a valid HTTPS connection cannot be established (expired certificate, wrong hostname), the browser shows an error and refuses to load the site. There is no "proceed anyway" option for HSTS-pinned sites.

HSTS Preloading

There is still a vulnerability for users who have never visited your site before — their browser has not seen the HSTS header yet, so the first connection could be attacked.

Browser vendors maintain hardcoded HSTS preload lists. If your domain is on the list, the browser enforces HTTPS from the very first visit — even before any server interaction. Chrome, Firefox, Safari and Edge all ship with the same preload list maintained at hstspreload.org.

Requirements to be added to the preload list:

• A valid HTTPS certificate on the root domain
• An HTTP → HTTPS redirect on the root domain
• HSTS header with max-age of at least 31536000 (one year)
• The includeSubDomains directive present
• The preload directive present

Warning: Preloading is difficult to undo. Once on the list, removal can take months to propagate to all browser releases. Only add the preload directive if all subdomains are served over HTTPS and you are committed to maintaining HTTPS for the foreseeable future.

Deployment Tips

• Start with a short max-age (e.g., 300 seconds) while testing. Gradually increase to 31536000 once you are confident HTTPS works on all paths.
• Ensure your TLS certificate is valid and renews automatically (Let's Encrypt with auto-renewal, or Cloudflare's managed certificates).
• Add includeSubDomains only after verifying every subdomain serves valid HTTPS — including any development or internal subdomains.
• HSTS is only sent over HTTPS. A plain HTTP response that includes HSTS is ignored by browsers.