Why Your Website Needs HSTS in 2026
One header, one config line, and downgrade attacks stop reaching your users. If your site doesn't ship HSTS in 2026, you're leaving free security on the table.
What HSTS does
Once a browser sees an HSTS header, it refuses to speak HTTP to that hostname for the duration of max-age. Every http:// link, redirect and typed URL is silently rewritten to https:// before it leaves the client.
Why now
Chrome and Safari both mark HTTP pages as Not Secure. Search engines demote HTTP pages. Modern browser APIs — Service Workers, WebAuthn, Push — refuse to work outside HTTPS. There is no benefit to leaving HSTS off in 2026.
How to ship it
Add Strict-Transport-Security: max-age=63072000; includeSubDomains; preload to your responses. Test with Website Auditor. Done.
Preloading
Submit at hstspreload.org. Every browser ships with your domain built in. Undoing preload takes months, so make sure every subdomain works over HTTPS first.