HTTP headers · Response
Strict-Transport-Security
Strict-Transport-Security tells browsers to use HTTPS for this host for a stated period.
Key facts
| Type | Response |
|---|---|
| HTTPS only | Ignored over plain HTTP |
| Syntax | <code>max-age=31536000</code> |
| Subdomains | <code>includeSubDomains</code> |
| Preload | <code>preload</code> plus registry submission |
| Effect | Future requests upgrade before contact |
| Risk | Hard to undo while max-age lasts |
| Standard | RFC 6797 |
Closing the downgrade window
Without HSTS, a user who types a bare hostname may make one plain-HTTP request before the redirect to HTTPS. An attacker on the network can intercept that first request. HSTS makes the browser remember that the host is HTTPS-only, so future navigations never start in clear text.
The policy applies only after a valid HTTPS response. A browser that has never seen the header will still try HTTP first, which is why the initial redirect must exist and why preload lists matter.
max-age and preload
max-age is a commitment in seconds. A one-year value is common; a short value is safer while testing. includeSubDomains extends the rule to every subdomain, including internal or legacy hosts that may not support HTTPS.
Preload adds the host to a list shipped with browsers, so even the first request uses HTTPS. Removal from the list takes months. Enable it only after every subdomain has stable TLS.
Frequently asked questions
Can I use HSTS on an HTTP-only site?
No. Browsers ignore the header unless it arrives over a secure connection.
How do I undo HSTS?
Send max-age=0 over HTTPS and wait for existing clients to refresh. Preloaded hosts must apply for removal.