Glossary / HSTS (Strict-Transport-Security)

HSTS (Strict-Transport-Security)

HSTS (Strict-Transport-Security) is an HTTP response header that tells the browser to talk to your site over HTTPS only. After the first visit the browser rewrites any http:// request to https:// on its own and refuses to load the site over an unencrypted connection, even if the user clicks a plain http link.

The server sends the Strict-Transport-Security header with a max-age value - how many seconds the browser should remember the rule. While it is valid, every request to the domain goes over HTTPS, and an attempt to open the http version turns into an internal redirect before the request ever leaves the machine.

This shuts down downgrade and first-hop interception attacks, where someone on the same network feeds the user an http version of the site. The includeSubDomains directive extends the rule to every subdomain, and preload lets you add the domain to the list built into browsers so the protection applies before the very first visit.

Turn HSTS on only once the whole site and its subdomains reliably serve HTTPS. Otherwise some pages become unreachable and you cannot roll it back quickly, because the browser keeps the rule until max-age runs out.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Common mistakes

• Setting a long max-age on a live site before every subdomain actually works over HTTPS, which locks visitors out of pages you forgot to migrate.
• Assuming HSTS turns HTTPS on. The header encrypts nothing; it only forbids http. You still need a valid certificate and working HTTPS.
• Adding the preload directive but never submitting the domain to hstspreload.org, so preload does nothing.
• Leaving out includeSubDomains and then wondering why an http-only subdomain still loads.

Related terms

• Content-Security-Policy (CSP) Content-Security-Policy (CSP)
• X-Frame-Options X-Frame-Options
• X-Content-Type-Options X-Content-Type-Options
• Referrer-Policy Referrer-Policy
• Permissions-Policy Permissions-Policy