Scan a site
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Security

HSTS (HTTP Strict Transport Security)

Published: · Updated:

HSTS (HTTP Strict Transport Security) is a security mechanism defined in RFC 6797, in which a site uses the Strict-Transport-Security header to declare that, for a given period (max-age), the browser must connect to it exclusively over HTTPS — automatically rewriting all HTTP requests to HTTPS before they are even sent.

HSTS closes the SSL stripping attack window: without it, the first HTTP request (e.g. after typing an address without a protocol) can be intercepted by an attacker on the same network and downgraded to an unencrypted connection. With HSTS active, the browser also refuses to let users bypass certificate errors.

Syntax and directives

  • max-age — the time in seconds the rule stays in force (recommended at least a year: 31536000).
  • includeSubDomains — extends protection to all subdomains.
  • preload — consent to add the domain to the browsers' built-in list (hstspreload.org), eliminating even the first HTTP request.

Deployment notes

The header only takes effect when sent over HTTPS. Roll out gradually: a short max-age first, then longer values and includeSubDomains, and preload only after ensuring all subdomains (including technical ones) support HTTPS — removal from the preload list takes months.

Example

A one-year policy with subdomain protection — a typical step before considering preload list submission.

HTTP 
Strict-Transport-Security: max-age=31536000; includeSubDomains

Sources & further reading

Related terms

Content Security Policy (CSP) An HTTP header declaring which sources the browser may load scripts, styles and other resources from. The main defense layer against XSS attacks.Canonical URL The address designated as the primary version of a page among duplicates (rel="canonical"). It consolidates ranking signals and prevents copies from being indexed.Time to First Byte (TTFB) The time from sending a request until the first byte of the server response arrives. The foundation of a fast LCP; a good score is roughly ≤ 800 ms.
Back to glossary

Check public security signals

Insight analyses headers, TLS and other visible signals — without claiming a pentest.

Scan a site free View a sample report
No credit card Report with date and sources No account required