headers8 min readUpdated 2026-01-08
HTTP Strict Transport Security (HSTS)
HSTS is the header that tells browsers to only ever speak HTTPS to your site. Once set, downgrade attacks and accidental http:// links stop reaching your server entirely.
The header
One line, three directives:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadPreloading
Submit your domain at hstspreload.org after you're confident every subdomain works over HTTPS. Preloading is essentially irreversible — undoing it takes months.
Common mistakes
Setting includeSubDomains before HTTPS works on every subdomain (breaks internal tools), or using a short max-age like 300 seconds which offers essentially no protection.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan