HSTS

HSTS (HTTP Strict Transport Security) is a response header that tells the browser to always use HTTPS for that domain, even if the user types http:// or clicks an old link.

The basic header

Strict-Transport-Security: max-age=31536000; includeSubDomains

• max-age — how long the browser remembers the rule, in seconds.
• includeSubDomains — applies to every subdomain.
• preload — submits the domain to the browser preload list; hard to undo.

How to roll it out safely

1. Make sure the whole site and all subdomains use HTTPS.
2. Start with a short max-age, such as 300 seconds.
3. Test the HTTP → HTTPS redirect and the certificate.
4. Raise max-age gradually.
5. Add includeSubDomains only after every subdomain is safe.
6. Consider preload as the final step.

What to watch for

• It is hard to undo. A browser that has received HSTS will refuse HTTP until max-age expires.
• Subdomains are included. One subdomain without HTTPS can become unreachable.
• It does not replace a valid certificate. HSTS only forces HTTPS; the certificate still has to be correct.
• The CDN must pass the header. Make sure the edge does not strip it.
• HSTS does not protect the first visit. The browser applies the rule only after receiving the header.
• Preload is not a small decision. It requires every subdomain and is difficult to reverse.

Use curl -I https://example.com and look for strict-transport-security. Check it on every subdomain too.

FAQ