Error guide / HSTS preload submission rejected
HSTS preload submission rejected
HSTS preloading means browsers ship with your domain in a built-in list and refuse to connect to it over plain HTTP, before they have ever seen your site. You apply by submitting the domain at hstspreload.org, which runs an automated check and rejects anything that does not meet all four requirements: serve a valid certificate; redirect HTTP to HTTPS on the same host; serve all subdomains over HTTPS; and serve the HSTS header on the base domain over HTTPS with max-age of at least 31536000 (one year), includeSubDomains present, and the preload token present. The people who hit this are usually owners or admins who moved to HTTPS long ago and expected preloading to be a formality. A rejection breaks nothing, your domain simply stays off the list until the failing condition is fixed and the domain is submitted again.
Check your site
What causes it
By far the most common reason is the header itself: max-age below 31536000, includeSubDomains missing, or the preload token missing. Next comes the redirect: the first hop from http://example.com has to land on https://example.com, the same host, so the common pattern of sending HTTP straight to https://www fails the requirement. Third are subdomains: any host under your domain that answers only over HTTP, or serves an invalid certificate, blocks eligibility, and forgotten hosts like dev., staging., mail. or webmail. count too. Also common: the header is served only on the www host, only over HTTP, or added by a CDN while the origin itself does not send it.
How to fix it
- Run the check on this page against your base domain, written without www, and read the three header conditions separately: the max-age value, whether includeSubDomains is present, whether preload is present. Whichever one it flags as missing or too low is almost certainly the rejection reason, because the header is the part nobody can judge by eye. If all three pass, your header is fine and the problem is in what this check cannot confirm for you: the certificate, the HTTP redirect, or a subdomain.
- List every hostname under your domain from the DNS zone in your hosting control panel and open each one over HTTPS. Forgotten hosts such as dev., old., staging., mail. and webmail. are the usual casualties. Fix, move or delete anything that cannot serve HTTPS with a valid certificate before you submit, because once the domain is preloaded, includeSubDomains makes those hosts unreachable for every visitor and there is no quick undo.
- Check the first redirect hop: curl -sI http://example.com must return a Location of https://example.com, the same host. A redirect that goes to https://www.example.com or to another domain first fails the requirement, even though the visitor does end up on HTTPS.
- Make sure the HSTS header is sent on the HTTPS response of the base domain itself, not only on www and not only by a CDN. If a proxy or edge adds the header, confirm the origin sends it as well, and if you serve a further redirect over HTTPS, the redirect response itself must carry the header, not just the page it points to.
- Ramp max-age instead of jumping to a year: start at 300, then 86400, then 604800, checking subdomains at each step, and only then set 31536000 together with includeSubDomains. Add the preload token last, after the full year value has run for a while with no reports of broken hosts.
- Resubmit at hstspreload.org once the change is live, and plan for the timeline: entries reach users only with new browser releases, and removal travels the same slow path, so a preloaded domain that breaks a subdomain stays broken for months for anyone who does not update.