HTTP Strict Transport Security (HSTS) for your website

1. What is HSTS?

HSTS is an HTTP response header that tells browsers to enforce HTTPS for a domain for a specified amount of time.

• It is advertised through the Strict-Transport-Security header on HTTPS responses.
• Once a browser has seen a valid HSTS header, it refuses to use plain HTTP for that domain until the max-age period has expired.
• HSTS can optionally apply to all subdomains and participate in a preload list built into major browsers.

2. Why you should enable HSTS on your website

Enabling HSTS is strongly recommended for any site that is meant to be served exclusively over HTTPS.

Risks when HSTS is missing

Without HSTS, attackers on an untrusted network (public Wi-Fi, captive portals, etc.) can interfere with the first HTTP request, downgrade users to plain HTTP or inject their own content before the browser upgrades to HTTPS.

Security and UX benefits of HSTS

• Browsers automatically rewrite http:// links to https:// for your domain after the first HSTS response.
• Mixed or outdated bookmarks, QR codes and redirects are less likely to expose users to insecure HTTP.
• Combined with a solid SSL configuration, HSTS significantly raises the bar against man-in-the-middle and downgrade attacks.

3. How to enable HSTS via HTTP headers

HSTS is configured by sending the Strict-Transport-Security header on HTTPS responses from your web server or reverse proxy.

Strict-Transport-Security header syntax

A typical production-ready HSTS header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Enabling HSTS on Apache / LiteSpeed (.htaccess)

On Apache and LiteSpeed, you can add the header in your virtual host configuration or in a .htaccess file:

    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Enabling HSTS on Nginx

On Nginx, add the header inside the HTTPS server block (not in the HTTP server block):

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # … SSL and site configuration …
}

Application frameworks, CDNs and reverse proxies

Many CDNs, load balancers and application frameworks also let you inject custom response headers. Wherever you configure it, make sure the header is added only on HTTPS responses and is not duplicated by intermediate layers.

4. HSTS preload list

The HSTS preload list is a set of domains baked directly into browsers, which are treated as HTTPS-only from the very first visit.

Requirements for HSTS preload

• Serve a valid certificate for your domain and all included subdomains.
• Send an HSTS header with a max-age of at least 31536000, including the includeSubDomains and preload directives.
• Redirect all HTTP traffic to HTTPS and ensure that all subdomains are reachable over HTTPS.

How to submit your domain for preload

• First, enable HSTS with the correct directives and test your site thoroughly.
• Check that HTTP is redirected to HTTPS everywhere and that no mixed-content issues remain.
• Then submit your domain through the official preload form and follow its validation instructions.

You can add your domain to the HSTS preload list here: hstspreload.org

Preload is effectively permanent in practice: removing a domain from the list can take months. Do not enable it unless you are absolutely sure that your domain and all subdomains will remain HTTPS-only.

5. Troubleshooting and safe rollout

Because HSTS can lock users out if misconfigured, it is wise to deploy it gradually.

• Start with a small max-age (for example 300 or 3600 seconds) and increase it once you are confident that everything works over HTTPS.
• If you accidentally set an overly aggressive header, lower the max-age and keep serving HTTPS until existing cached policies expire.
• Avoid enabling includeSubDomains or preload until all subdomains are audited and ready.

Once a browser has cached an HSTS policy, there is no server-side way to force it to forget that policy early. Changes only take effect when the cached max-age expires.

6. Test HSTS manually from your own terminal

The HSTS section in DNSprobe checks whether your HTTPS responses include the Strict-Transport-Security header, and if options such as includeSubDomains and preload are enabled. You can inspect the same header yourself from a terminal using curl against the HTTPS version of your site.

Linux: using curl to read the Strict-Transport-Security header

On most Linux distributions, curl is installed or available in the default repositories. The following commands fetch only the HTTP response headers over HTTPS so you can verify whether HSTS is present and how it is configured:

                curl -I https://example.com/
    
                # Look for the Strict-Transport-Security header and check the max-age, includeSubDomains and preload directives    
                curl -I https://sub.example.com/
    
                # If you use includeSubDomains, test a subdomain as well to confirm that HSTS is applied consistently
        

macOS: using curl from the built-in tools

macOS ships with curl as part of its standard command-line tools. Open Terminal and run the same commands as on Linux to confirm that your HTTPS responses include a Strict-Transport-Security header with the expected directives:

                curl -I https://example.com/
    
                # Look for the Strict-Transport-Security header and check the max-age, includeSubDomains and preload directives    
                curl -I https://sub.example.com/
    
                # If you use includeSubDomains, test a subdomain as well to confirm that HSTS is applied consistently
        

Windows: using curl from Command Prompt or PowerShell

On modern versions of Windows 10 and 11, curl is included by default. From a Command Prompt or PowerShell window, you can use curl in exactly the same way as on Linux/macOS to verify your HSTS header:

                curl -I https://example.com/
    
                REM Look for the Strict-Transport-Security header and check the max-age, includeSubDomains and preload directives    
                curl -I https://sub.example.com/
    
                REM If you use includeSubDomains, test a subdomain as well to confirm that HSTS is applied consistently
        

Important: only test hosts and domains that you own or are authorised to analyse. Repeated automated HTTPS header checks against third-party systems without permission may be treated as abusive behaviour by some providers.