Syntax and directives
- max-age: lifetime in seconds, refreshed by each valid HTTPS response carrying the header.
- includeSubDomains: extends protection to all subdomains.
- preload: signals consent for submission; the keyword alone does not add a domain to browser lists.
Deployment notes
The header only takes effect when sent over HTTPS. Roll out gradually: a short max-age first, then longer values and includeSubDomains, and preload only after ensuring all subdomains (including technical ones) support HTTPS, because removal from the preload list takes months.
Example
A one-year policy with subdomain protection. A typical step before considering preload list submission.
Strict-Transport-Security: max-age=31536000; includeSubDomainsStart with a short lifetime and verify HTTPS and subdomains before extending it. A valid HTTPS response with max-age=0 can disable a learned policy, but does not remove preload or an ancestor domain policy. Without working HTTPS, delivering a change may be impossible.
A list built into browsers of domains treated as HTTPS-only before the first visit ever happens. Submission at hstspreload.org requires a header with max-age of at least a year, the includeSubDomains directive and the preload keyword.
Yes, but slowly: removal has to be requested and then ship with a new browser version, which takes months. Preload is therefore worth enabling only once every subdomain, internal and staging ones included, definitely serves HTTPS.
Because browsers discard Strict-Transport-Security received over an unencrypted connection. The header only counts in a response sent over HTTPS, because otherwise an attacker could simply replace it.