Strict-Transport-Security
SecurityActiveThe Strict-Transport-Security (HSTS) header tells browsers to only access the site over HTTPS for a specified duration. Once received, browsers automatically upgrade all HTTP requests to HTTPS and refuse to connect if the certificate is invalid – protecting against downgrade attacks and MITM.
Strict-Transport-Security: max-age=<seconds>[; includeSubDomains][; preload]
Description
HSTS prevents protocol downgrade attacks by instructing browsers to always use HTTPS. The max-age directive specifies how long (in seconds) browsers should remember this. includeSubDomains extends protection to all subdomains. Preload submits the domain to browser HSTS preload lists built into Chrome, Firefox, and Safari.
Directives
| Directive | Description |
|---|---|
| max-age=<seconds> | Duration browsers should enforce HTTPS. Minimum: 1 year (31536000). Recommended: 2 years (63072000). |
| includeSubDomains | Extends HSTS policy to all subdomains. Required for HSTS preload. |
| preload | Indicates intent to be included in browser preload lists. Requires includeSubDomains and max-age ≥ 31536000. |
Examples
Basic HSTS (1 year)
http
Strict-Transport-Security: max-age=31536000With subdomains (2 years)
http
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload