Cart 0

No products in the cart.

Account

Web security basics

What Is HSTS and Should You Enable It?

HSTS tells browsers to load your site only over HTTPS, even when someone types or clicks an http:// link. Here is what it does, when it can break things and how to roll it out safely.

3 min read

What is HSTS? HTTP Strict Transport Security (HSTS) is a response header that tells browsers to connect to your domain only over HTTPS for a set period. Once a browser has seen the header, it upgrades every http:// request to https:// on its own – before anything leaves the device – and refuses to let visitors click past certificate errors. HSTS is defined in RFC 6797 and supported by all major browsers.

Key factDetail
Header nameStrict-Transport-Security
Where it worksOnly when sent over HTTPS; browsers ignore it on plain HTTP
Main directivesmax-age (seconds), includeSubDomains, preload
Protects againstProtocol downgrade and SSL-stripping attacks, accidental http:// links
PrerequisiteA valid certificate on every host the policy covers

Check your certificate before enabling HSTS

HSTS blocks visitors from clicking past certificate errors. Make sure your certificate, chain and hostnames are correct first.

Run the SSL checker

What does HSTS do?

HSTS forces HTTPS in the browser. A normal HTTP-to-HTTPS redirect still lets the first request go out unencrypted, and an attacker on the same network can intercept that request and keep the visitor on HTTP. With HSTS, the browser remembers your policy and never makes that unencrypted request again until max-age runs out.

It also hardens certificate errors. When a site with an active HSTS policy presents an invalid certificate, the browser shows an error page without the “proceed anyway” option. That protects visitors from fake certificates – and it means a certificate mistake on your side takes the site offline for them.

HSTS is one step of a full migration. If you have not switched yet, first move from HTTP to HTTPS and fix redirects and mixed content; add HSTS once everything loads cleanly over HTTPS.

Should you enable HSTS?

Yes, for almost every public website that already runs fully on HTTPS. Hold back or start with a short max-age if any of the points on the list apply to you.

  • A subdomain still serves plain HTTP (old intranet, webmail, test host)
  • You rely on manual certificate renewals and have let one expire before
  • Third-party services run on your subdomains via CNAME without HTTPS
  • You might move the domain to a host that cannot serve HTTPS
  • You are unsure who controls all DNS records under the domain

Can HSTS break your site?

Yes, if the policy covers a host that cannot serve valid HTTPS. The two settings that cause trouble are includeSubDomains and a long max-age.

  • includeSubDomains: applies the policy to every subdomain, including ones you forgot – a printer interface, a legacy app or a vendor-hosted page without a certificate becomes unreachable.
  • Long max-age: browsers keep the policy for the whole period. If you need to go back to HTTP, visitors who already have the policy cannot reach the HTTP version until it expires.
  • Expired or wrong certificate: with HSTS active, visitors cannot click through the warning, so the outage is total.
Tip: Roll out in stages: start with max-age=300 (five minutes), then one week, then one month, and only then one year. Add includeSubDomains after you have checked every subdomain.

What is HSTS preload?

HSTS preload is a list of domains built into browsers that are HTTPS-only from the very first visit. The list is maintained through hstspreload.org for Chrome, and other major browsers base their own preload lists on it. It closes the gap on a visitor’s first ever request, before any header has been seen.

Preloading is hard to undo. Removal reaches users only with browser updates, which takes months, and other browsers are not guaranteed to follow. Only preload a domain you are certain will stay on HTTPS, with every subdomain, for good.

How to enable HSTS safely

  1. Confirm HTTPS everywhere

    Every host on the domain serves a valid certificate and redirects HTTP to HTTPS on the same host.

  2. Send a short policy

    Add the header with max-age=300 over HTTPS and watch for errors.

  3. Raise max-age in steps

    Increase to one week, one month and then 31536000 seconds (one year).

  4. Decide on subdomains and preload

    Add includeSubDomains after an audit; add preload and submit at hstspreload.org only if you are sure.

How do you enable HSTS? Header examples

You add one response header on the HTTPS version of your site. These examples use the final one-year policy; start with a lower max-age as described above.

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Place it in the <VirtualHost *:443> block; mod_headers must be enabled.

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Place it in the server block that listens on 443.

For preload submission

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

The preload list requires at least one year of max-age, includeSubDomains and preload on the base domain, plus a valid certificate and an HTTP-to-HTTPS redirect on the same host. If a CDN or WordPress plugin manages your headers, set HSTS there instead to avoid duplicate headers. Terms like max-age and SSL stripping are also explained in our SSL glossary.

After deploying, run our SSL checker to confirm the certificate and chain are valid on every hostname the policy covers.

Test before you raise max-age

Check certificate validity, chain and hostname coverage for each subdomain your HSTS policy will reach.

Check your SSL certificate

Related articles

Frequently asked questions

What does HSTS do?

HSTS forces HTTPS. When a browser receives the Strict-Transport-Security header over a secure connection, it stores your policy and converts every later http:// request to your domain into https:// before sending it, for as long as max-age says. It also removes the option to click past certificate errors. This blocks downgrade and SSL-stripping attacks that exploit the first unencrypted request of a normal redirect.

What is HSTS preload?

HSTS preload is a list of domains built into browsers so they use HTTPS from the very first visit, before any header has been seen. You submit your domain at hstspreload.org, which requires a one-year max-age, includeSubDomains and the preload directive. Inclusion is hard to undo: removal only reaches users through browser updates over months, and other browsers may not follow.

Can HSTS break my site?

Yes, if the policy covers a host that cannot serve valid HTTPS. With includeSubDomains, any subdomain without a working certificate becomes unreachable. A long max-age keeps the policy in browsers for its whole duration, so you cannot quickly return to HTTP. And because visitors cannot click past certificate warnings, an expired certificate causes a full outage. Start with a short max-age and raise it step by step.

How do I enable it?

Send the Strict-Transport-Security header over HTTPS. In Apache, use Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" inside the port-443 virtual host. In Nginx, use add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; in the 443 server block. Start with max-age=300, raise it gradually, and add preload only if you plan to submit to the preload list.