HSTS: telling browsers "only ever reach this site over HTTPS"
2 min read
What HTTP Strict Transport Security does, the attack it prevents, and how to enable it. max-age, includeSubDomains and preload options, with the caveats that matter.
The problem it solves
Even on an HTTPS site, a visitor's first request often starts as HTTP (a bare name typed into the address bar) and gets redirected. An attacker in the path can intercept that first HTTP step and keep the visitor on an unencrypted copy (SSL stripping). The HSTS header tells the browser: "never connect to this domain over HTTP again" — the browser remembers, and skips the HTTP step entirely on future visits.
Enabling it
Add one line to your HTTPS responses: Strict-Transport-Security: max-age=31536000; includeSubDomains. max-age is how many seconds browsers remember the rule (one year is common); includeSubDomains extends it to every subdomain — which will break any subdomain still on plain HTTP, so add it only when you are sure.
preload is the final step: your domain ships inside browsers' built-in list, so even the first-ever visit skips HTTP. Powerful, but reversal takes months; do not submit unless every subdomain is permanently HTTPS.
Checking it
An SSLx query shows whether HSTS is enabled in the technical summary. Remember the header only counts on HTTPS responses; HSTS on an HTTP response is ignored by design.
Test your own site
SSLx performs every diagnosis in this guide in ten seconds: chain verification, hostname matching, expiry and HSTS — free, no signup.
Test with SSLxFrequently asked questions
Does HSTS change how certificate errors behave?
Yes, deliberately: with HSTS active, browsers show certificate warnings without a "proceed anyway" option. That amplifies the impact of an expired certificate — automated renewal becomes even more critical.
Does HSTS help SEO?
Indirectly: it removes the HTTP→HTTPS redirect hop for returning visitors, improving time to first byte; and HTTPS itself is a Google ranking signal.