HSTS: How to Set Up HTTP Strict Transport Security Safely

Strict-Transport-Security, usually called HSTS, is one of the headers our security headers checker looks for first. If your site already runs on HTTPS, it's a one-line change. But it's the one security header where a careless setting can make part of your site unreachable for months, so it's worth doing in the right order.

Here's what it does, what each part means, and how to switch it on safely.

What problem HSTS solves

Your site has an HTTPS certificate and probably redirects http:// to https://. That's good, but there's a gap. The very first request, when someone types yourdomain.co.uk or clicks an old http:// link, goes out unencrypted before your server redirects it.

On a public Wi-Fi network, that first unencrypted request can be intercepted. An attacker in the middle can stop the redirect happening and keep the visitor on a fake, unencrypted copy of your site without them noticing. This is called a downgrade or SSL stripping attack.

HSTS closes the gap. Once a browser has seen the header from your site, it remembers, and for as long as you tell it to, it will only ever connect over HTTPS. It changes http:// to https:// itself, before anything goes over the network. If the HTTPS connection fails, for example because of a certificate problem, it refuses to load the page rather than letting the visitor click through a warning.

What the header looks like

Strict-Transport-Security: max-age=31536000; includeSubDomains

It has up to three parts:

Our checker passes HSTS with a max-age of at least six months, and recommends a year. That's also the common bar set by other security tools.

The one thing to get right first

HSTS is cached by each visitor's browser. If you set a year-long max-age and then something on your domain stops working over HTTPS, browsers that have seen the header will refuse to load it, and there's nothing you can do from your server to make them forget until the time runs out.

So before you switch it on, check:

• Every page on your main site works over HTTPS, with no mixed-content warnings.
• http:// redirects to https:// for every page, not just the homepage. Our redirect checker shows where each version of your address ends up.
• If you'll use includeSubDomains, every subdomain works over HTTPS too. This is where most problems come from: an old mail. webmail login, a shop. subdomain on a third-party platform, a forgotten test site, or a printer or router admin page someone set up on a subdomain years ago.

How to roll it out safely

Increase the max-age in steps, checking for problems at each one:

1. Start with five minutes: max-age=300. If anything breaks, browsers forget within minutes.
2. Move to a week: max-age=604800. Leave it for a week and watch for reports of pages not loading.
3. Add includeSubDomains once you've confirmed every subdomain works on HTTPS, still at a week.
4. Move to a year: max-age=31536000.

For a small brochure site with no subdomains, you can move through this quickly. The point is not to jump straight to a year on a domain you haven't checked.

How to add it

HSTS must be sent as an HTTP header, and browsers only take notice of it when it arrives over HTTPS. Sending it over plain http:// does nothing. A <meta> tag in your page HTML doesn't work either.

Apache (in your HTTPS site config, or .htaccess if your host allows it; needs mod_headers):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Nginx (in the HTTPS server block):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Vercel (in vercel.json; Vercel already sends an HSTS header by default, so set your own only if you want includeSubDomains or a different max-age):

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }
      ]
    }
  ]
}

Netlify (in a _headers file in your publish folder):

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Cloudflare: if your site sits behind Cloudflare, HSTS can be switched on in the SSL/TLS settings under Edge Certificates, where you choose the max-age and whether to include subdomains.

WordPress: best added at the server level, by you or your host, with one of the snippets above. Some security plugins add it too; check it isn't being added twice.

Hosted website builders (Wix, Squarespace, Shopify and similar) control the headers for you, and many already send HSTS. Run your domain through the checker to see what yours sends. If it's missing, it's a question for the platform's support team.

Should you use preload?

Browsers ship with a built-in list of domains that are HTTPS-only from the very first visit, so not even the first request is ever sent unencrypted. You can apply to join at hstspreload.org. To qualify, your header needs a max-age of at least a year, includeSubDomains, and preload, and your site must redirect http:// to https://.

For most small businesses, don't rush into it. Once your domain is in the list, every subdomain must work over HTTPS for good, and getting removed takes months, because the list ships with browser updates. A normal HSTS header with a year-long max-age gives nearly all the protection, and you keep the option to change your mind.

Preload makes sense for sites handling payments or logins, where you're confident you control every subdomain now and in future.

Does HSTS help SEO?

Not directly. Google uses HTTPS as a small ranking signal, and HSTS doesn't add to that. What it does is make sure visitors, and Google, always reach the HTTPS version without an extra redirect hop for returning visitors. It belongs in the same group as the other security headers: it protects your visitors, and it tells anyone who checks that the site is looked after.

Check your site

Run your domain through the free security headers checker. It reads the headers your server actually sends and tells you whether HSTS is set and whether its max-age is long enough, alongside the other headers that matter, such as X-Frame-Options and Content-Security-Policy.

For how HSTS fits with HTTPS and the rest of the security headers, see our guide to HTTPS and security headers. The website security audit guide covers the rest of the checklist.