---
title: HSTS
description: A header that forces browsers to use HTTPS. Start with a short max-age before includeSubDomains or preload.
canonical: https://penasihathosting.com/en/hosting-wiki/hsts
type: wiki
locale: en
updated: 2026-10-29
author: Willya Randika
---

# HSTS

## Overview

- **Summary:** A header that forces browsers to use HTTPS. Start with a short max-age before includeSubDomains or preload.
- **Author:** Willya Randika ([profile](/penulis/willya-randika))

## Article

**HSTS (HTTP Strict Transport Security)** is a response header that tells the browser to **always** use HTTPS for that domain, even if the user types `http://` or clicks an old link.

## The basic header

```http
Strict-Transport-Security: max-age=31536000; includeSubDomains
```

- `max-age` — how long the browser remembers the rule, in seconds.
- `includeSubDomains` — applies to every subdomain.
- `preload` — submits the domain to the browser preload list; hard to undo.

## How to roll it out safely

1. Make sure the whole site and all subdomains use HTTPS.
2. Start with a short `max-age`, such as 300 seconds.
3. Test the HTTP → HTTPS redirect and the certificate.
4. Raise `max-age` gradually.
5. Add `includeSubDomains` only after every subdomain is safe.
6. Consider `preload` as the final step.

## What to watch for

- **It is hard to undo.** A browser that has received HSTS will refuse HTTP until max-age expires.
- **Subdomains are included.** One subdomain without HTTPS can become unreachable.
- **It does not replace a valid certificate.** HSTS only forces HTTPS; the certificate still has to be correct.
- **The CDN must pass the header.** Make sure the edge does not strip it.
- **HSTS does not protect the first visit.** The browser applies the rule only after receiving the header.
- **Preload is not a small decision.** It requires every subdomain and is difficult to reverse.

Use `curl -I https://example.com` and look for `strict-transport-security`. Check it on every subdomain too.

## FAQ

<Accordion>
  <AccordionItem title="Does HSTS apply immediately?">
    No. The browser applies the rule after receiving the header over a valid HTTPS connection. The first visit can still use HTTP.
  </AccordionItem>
  <AccordionItem title="Can HSTS make a site unreachable?">
    Yes, if a subdomain does not support HTTPS. That is why you start with a short max-age and test every subdomain.
  </AccordionItem>
  <AccordionItem title="Is HSTS the same as an HTTPS redirect?">
    No. A redirect sends HTTP requests to HTTPS. HSTS tells the browser not to use HTTP in the first place.
  </AccordionItem>
</Accordion>