What HSTS does
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to reach your domain only over HTTPS for a set period. Once a browser has seen it, it rewrites any http:// link or typed address to https:// before sending anything. It also stops users from clicking through certificate errors on that host.
Browsers honor the header only when it arrives over a valid HTTPS connection. Sent over plain HTTP it is ignored, because an attacker on the path could have added or removed it.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadThe three directives
The header has one required directive and two optional ones.
- max-age: how long, in seconds, the browser remembers the policy. 31536000 is one year. Every response with the header restarts the timer, and max-age=0 tells the browser to forget the policy.
- includeSubDomains: extends the policy to every subdomain of the host that sent it, such as www, api and any internal names.
- preload: signals consent to inclusion in the browser preload list. On its own it changes nothing until the domain is submitted and accepted.
What HSTS prevents
Without HSTS, a visitor who types example.com starts with a plain HTTP request and relies on your redirect to reach HTTPS. An attacker on the same network can intercept that request and keep the visitor on HTTP while talking to your real site over HTTPS. This protocol downgrade is known as SSL stripping.
HSTS removes the plaintext step for domains the browser remembers. It also keeps cookies off plain HTTP. Every request to the host is upgraded before it leaves the browser, so even a cookie without the Secure flag isn't sent in clear text there. Set Secure on cookies anyway.
The first-visit gap
HSTS is learned from a response. The first request a browser ever makes to your site, or the first after the policy expires, can still go over HTTP. A visitor on a hostile network at that moment is exposed.
There is a quieter gap too. An includeSubDomains policy on example.com takes effect only after the browser visits example.com itself. People who only ever open www.example.com may never receive it.
Preloading closes both gaps by shipping your domain inside the browser.
Preload list requirements
Chromium maintains the HSTS preload list through hstspreload.org, and most major browsers base their own lists on it. To be accepted, a domain must:
- Serve a valid certificate.
- Redirect HTTP to HTTPS on the same host, if it listens on port 80.
- Serve every subdomain over HTTPS, including www if a DNS record for it exists.
- Send the header on the base domain with a max-age of at least 31536000 seconds (one year), includeSubDomains and preload.
- Keep sending the header on any further redirect served over HTTPS.
Why preloading too early is risky
A preload entry covers every subdomain, including internal tools, staging hosts and old devices that only speak HTTP. Once you are listed, browsers refuse to reach any of them over HTTP, and removal takes months to reach users through browser updates.
Raise the policy in stages. Start with a short max-age, such as 300 seconds, without includeSubDomains. Add includeSubDomains once every subdomain has a valid certificate and works over HTTPS, then raise max-age step by step to a year and submit for preload last.