Home / Knowledge hub / HSTS
Knowledge hub
HSTS
A header telling browsers to use HTTPS only for your site, every time.
What it means
HSTS, HTTP Strict Transport Security, is a response header that tells a browser to talk to your site only over HTTPS for a stated period. It is defined in RFC 6797. After the browser has seen it, a request to an http address is upgraded to https inside the browser, before anything leaves the machine.
The header itself looks like Strict-Transport-Security: max-age=31536000; includeSubDomains. The browser ignores it on plain HTTP, so it only takes effect after a first secure visit. A preload list built into browsers closes that first-visit gap for sites that opt in to it.
Why it matters
Redirecting http to https is not enough, because the first request still goes out in the clear and can be intercepted. Attackers on public Wi-Fi use this gap to strip the encryption or redirect to a lookalike site. HSTS removes the plain request, and with it the opening.
It also removes the click-through option. On an HSTS site the browser will not let a visitor accept a certificate error, which blocks a common trick. Enterprise customers and security reviews expect the header, and its absence is a routine finding on a security headers check.
How it shows up
Set it on every HTTPS response. Start with a short max-age while you check that everything works, then raise it to a year. includeSubDomains covers all subdomains, so make sure none of them still needs HTTP. Preloading, through hstspreload.org, needs a max-age of at least a year, includeSubDomains and the preload token.
The mistakes: setting it only on the main page and not on API or asset hosts, using includeSubDomains before fixing an old HTTP-only subdomain, and preloading without understanding it is slow to undo. Pair with the Secure cookie flag and a valid HTTPS setup. Check with a header viewer.
Questions people ask
HSTS, answered
Is a redirect from HTTP to HTTPS enough?
No. The first request still goes out unencrypted before the redirect arrives, and that request can be intercepted or altered. HSTS makes the browser upgrade it locally, so the plain request never leaves.
Keep the redirect too, for first-time visitors.
What does max-age mean?
It is the number of seconds the browser remembers to use HTTPS only. 31536000 is one year. Each visit refreshes the timer.
Setting it to zero tells browsers to forget the rule, which is how you back out.
What is the HSTS preload list?
It is a list of domains built into major browsers, so they use HTTPS even on the very first visit. You apply for it and must meet its conditions, including a long max-age and includeSubDomains.
Removal can take months, so be sure before joining.
Can HSTS break my site?
Yes, if a subdomain or internal tool still uses HTTP or has an invalid certificate. Browsers will refuse to load it with no way to click past. Test subdomains first and start with a short max-age.
That is the main reason to roll out in steps.
Does HSTS protect against all attacks on HTTPS?
No. It prevents downgrade and plain-text first requests, but does not fix a weak TLS setup, a bad certificate or application flaws. It is one layer in a wider setup.
See TLS.
Related
Terms that sit next to this one
HTTPS
The encrypted web protocol, and the minimum for anything with a login.
TLS
The protocol that encrypts traffic between a browser and a server.
Security headers
Response headers that switch on browser protections against common web attacks.
Secure cookie flag
A setting that makes the browser send a cookie only over HTTPS.
Mixed content
An HTTPS page loading some resources over plain HTTP, which can be tampered with.
Can the first request be intercepted?
We check the headers and transport settings your running app returns, including HSTS, and report what is missing or too weak with the response that showed it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.