Support Library

HSTS: HTTP Strict Transport Security

HSTS is a response header that tells browsers to use HTTPS for your site every time, for a period you choose. Without it, the first request a browser makes is often plain HTTP, and that one request is enough for an attacker to keep the visitor off HTTPS.

Author
CategoryWebsite Security
Length5 minute read
UpdatedNovember 1, 2026

The short answer

Once your whole site works on HTTPS, send this header on every HTTPS response:

Strict-Transport-Security: max-age=31536000; includeSubDomains

max-age is how many seconds the browser remembers the rule (31536000 is one year). includeSubDomains extends it to every subdomain. Start with a short max-age and raise it once you are sure nothing breaks.

How HSTS stops a downgrade

An SSL stripping attack with and without HSTS Top, without HSTS: the visitor types example.com, the browser sends a plain http request, an attacker on the network intercepts it, talks HTTPS to the real site, and passes an unencrypted copy back, so the visitor never reaches HTTPS. Bottom, with HSTS: the browser already remembers the site’s HSTS rule, upgrades the request to https before it leaves the device, and the attacker can only see encrypted traffic. Without HSTS: SSL stripping Visitor Types example.com Browser Sends http:// first Attacker on the path Answers on http:// Talks HTTPS to the site Visitor stays on HTTP Sees a working site The redirect never reaches the visitor Logins and cookies are captured With HSTS Visitor Types example.com Browser knows HSTS Upgrades to https:// itself TLS to the real site Certificate must be valid Encrypted page No http:// request sent No plain HTTP request to intercept Certificate warnings cannot be clicked through An SSL stripping attack with and without HSTS Top, without HSTS: the visitor types example.com, the browser sends a plain http request, an attacker on the network intercepts it, talks HTTPS to the real site, and passes an unencrypted copy back, so the visitor never reaches HTTPS. Bottom, with HSTS: the browser already remembers the site’s HSTS rule, upgrades the request to https before it leaves the device, and the attacker can only see encrypted traffic. Without HSTS: SSL stripping Visitor Types example.com Browser Sends http:// first Attacker on the path Answers on http:// Talks HTTPS to the site Visitor stays on HTTP Sees a working site The redirect never reaches the visitor Logins and cookies are captured With HSTS Visitor Types example.com Browser knows HSTS Upgrades to https:// itself TLS to the real site Certificate must be valid Encrypted page No http:// request sent No plain HTTP request to intercept Certificate warnings cannot be clicked through
A redirect only helps if it reaches the browser. HSTS makes the browser skip the http:// request entirely, so there is nothing for an attacker to intercept.

This attack, known as SSL stripping, was demonstrated with the sslstrip tool in 2009. A redirect from http:// to https:// does not stop it, because the attacker sits between the visitor and the redirect. HSTS works because the decision happens inside the browser before any request is sent.

How DNS Panopticon detects it

Security Posture reads the Strict-Transport-Security header on your HTTPS homepage and looks at its max-age. The result appears on the Website Application Security card.

FindingSeverityWhen it appears
No HSTS headerMediumThe header is missing, or max-age=0, which tells browsers to forget the rule.
HSTS lasts less than 180 daysLowmax-age is below 15552000 seconds, so browsers forget the rule quickly.
HSTS is onPassmax-age is at least 180 days. The finding also notes when the header asks for preloading.

The check is skipped when the site has no HTTPS at all, since browsers ignore HSTS sent over plain HTTP. Fix HTTPS and the redirect first.

How to check it yourself

Command or toolWhat to look for
curl -sI https://example.comA strict-transport-security line and its max-age.
curl -sI https://www.example.comThe same header on each host visitors use.
chrome://net-internals/#hstsIn Chrome or Edge, “Query HSTS/PKP domain” shows whether the browser has stored a rule for the domain.

In browser developer tools, open the Network tab, select the page request and look under Response Headers. You can also check preload status at hstspreload.org.

Why it matters

  • The first request is exposed. Typed addresses, bookmarks and links that start with http:// all begin unencrypted unless the browser already knows to upgrade them.
  • Public networks. Hotel, café and airport Wi-Fi are exactly where someone can sit in the middle of traffic.
  • Certificate warnings. With HSTS, browsers do not let users click past a certificate error for the site, which removes a common way people are tricked into accepting a fake certificate.
  • Short max-age. A rule that expires after a day or a week protects only people who visit often. A year keeps occasional visitors protected too.

How to fix it

  1. Make sure everything is on HTTPS, including every subdomain if you plan to use includeSubDomains. Intranet hosts or old services that still use plain HTTP will stop working in browsers that have seen the rule.
  2. Start small. Send max-age=300 (five minutes) and test. Then raise it to a week, a month, and finally a year.
  3. Add includeSubDomains when every subdomain serves HTTPS.
  4. Consider preloading. Browsers ship a built-in list of HSTS domains, so even the very first visit is protected. To join, the site must redirect http to https on the same host, serve the header on the bare domain with max-age of at least 31536000, includeSubDomains and preload, then you submit it at hstspreload.org. Removal takes months, so only preload when you are sure.
PlatformSetting
nginxadd_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; in the HTTPS server block
ApacheHeader always set Strict-Transport-Security "max-age=31536000; includeSubDomains" (needs mod_headers)
IIS 10 (version 1709 and later)Site → HSTS: enable it, set Max-Age, IncludeSubDomains and Redirect Http to Https
CloudflareSSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS)
Application codeSet the header in middleware, for example Helmet in Express or UseHsts in ASP.NET Core

To undo HSTS, send max-age=0 over HTTPS. Browsers that see it forget the rule, but browsers that do not visit keep it until their stored max-age runs out.

FAQ

Should I send HSTS on the http:// response too?

It does no harm, but browsers ignore it. RFC 6797 says the header only counts when it arrives over a secure connection, so an attacker cannot set or remove it on plain HTTP.

Does HSTS replace the http:// to https:// redirect?

No. Keep the redirect for visitors whose browser has not seen your HSTS header yet, and for tools that do not support HSTS. HSTS protects every visit after the first, or every visit at all if the domain is preloaded.

What max-age should I use?

One year (31536000) is the common choice and the preload minimum. DNS Panopticon flags anything under 180 days (15552000), the threshold many security guides use.

Can HSTS break my site?

Only if part of it does not work over HTTPS. With includeSubDomains, any subdomain that is HTTP only becomes unreachable in browsers that stored the rule, which is why the rollout starts with a short max-age.

Sources and further reading

Related support articles

HTTPS and HTTP-to-HTTPS RedirectsMixed ContentForms and Passwords Sent over Plain HTTPDANE for HTTPSSVCB and HTTPS DNS RecordsCAA Records – Deep Dive