What Is HSTS?
HTTP Strict Transport Security (HSTS) is a response header that forces browsers to use HTTPS for
your site and refuse to downgrade to plain HTTP. It closes a real gap: even on an HTTPS site, the
very first request a user types is often http://, and an attacker on the network can intercept
that moment to strip encryption. HSTS tells the browser to never allow it.
What attack does HSTS close?#
SSL stripping. Without HSTS, the sequence is:
- User types
example.com(defaults tohttp://). - An on-path attacker intercepts the plaintext request.
- They proxy the connection, keeping it HTTP to the victim while talking HTTPS to the server.
- The victim’s traffic is now readable.
HSTS breaks this because, after the first secure visit, the browser refuses to make an HTTP request to the domain at all — it upgrades to HTTPS internally before anything leaves the machine.
Strict-Transport-Security: max-age=31536000; includeSubDomainsHow do you deploy it safely?#
| Step | Setting |
|---|---|
| Start conservatively | max-age=86400 (one day) |
| Confirm all subdomains are HTTPS | before adding includeSubDomains |
| Increase duration | up to max-age=31536000 (one year) |
| Preload (optional, last) | add preload, submit to the list |
HSTS is a foundational security header and part of protecting sensitive data in transit. More at the Web Security hub.
Frequently asked questions#
What does HSTS do?
HTTP Strict Transport Security is a response header that tells the browser to only ever connect to a site over HTTPS for a set period, refusing any plain-HTTP connection or downgrade. It closes the window where an attacker could intercept an initial insecure request and strip encryption, a technique called SSL stripping.
What is HSTS preloading and why is it risky?
Preloading submits your domain to a list hard-coded into browsers, so they use HTTPS even on the very first visit. It is the strongest form of HSTS but near-permanent: if any subdomain still needs HTTP, it will break, and removal from the list is slow. Preload only once every subdomain is HTTPS-only.