SSL and TLS

What is HSTS (HTTP Strict Transport Security)?

A redirect from HTTP to HTTPS still lets the very first request travel unprotected. HSTS closes that gap by making the browser skip HTTP altogether.

HSTS (HTTP Strict Transport Security) is a response header, Strict-Transport-Security, that tells a browser to connect to your domain only over HTTPS for the number of seconds you give it in max-age. After the first visit, the browser upgrades any http:// link to https:// itself before sending anything, and refuses to let the user click through a certificate error. A typical value is Strict-Transport-Security: max-age=31536000; includeSubDomains, which means one year, covering every subdomain. The browser ignores the header if it arrives over plain HTTP, so it only protects visitors after a secure first load unless the site is on the preload list.

Worked out 2026-10-16 (IST) · HSTS as specified in RFC 6797, delivered over a valid HTTPS connection

The directives

What goes in the header
Directive	Effect	Risk
max-age=N	Remember "HTTPS only" for N seconds from the last visit	A long value is hard to undo
includeSubDomains	Applies to every subdomain too	Breaks any subdomain that does not have a working certificate
preload	Signals consent to be added to the browser preload list	Effectively permanent; do not add casually

What changes for the visitor

With and without HSTS
Situation	Without HSTS	With HSTS
Typing example.com	Browser sends a plain HTTP request, then follows a redirect	Browser upgrades to HTTPS before sending anything
Clicking an old http:// link	First request is unencrypted	Upgraded locally, no unencrypted request
Certificate expired or wrong	User can click "proceed anyway"	Browser blocks the connection, no bypass
Attacker strips HTTPS on public Wi-Fi	Possible on the first request	Defeated after the first secure visit

The mistake that locks people out

Because HSTS removes the click-through option, an expired certificate on an HSTS site is a hard failure: nobody can reach the site until you renew. Teams that set a one-year max-age and then forget to automate renewal turn a routine expiry into a full outage. That risk is why HSTS belongs after, not before, a reliable renewal process, and why knowing how to check the certificate expiry date matters more on an HSTS site than on any other. With maximum certificate lifetimes shrinking, see how long an SSL certificate is valid for the schedule.

A safe rollout

Step by step
Step	Action
1	Make sure every page and every subdomain you own works over HTTPS
2	Redirect all HTTP requests to HTTPS with a 301
3	Send max-age=300 and watch for errors for a day
4	Raise it in stages to 31536000
5	Add includeSubDomains only when every subdomain is confirmed
6	Consider preload last, and only for a domain you intend to keep on HTTPS for good

If HTTPS is not working on a host in the first place, start with why an SSL certificate is not trusted and fix that before adding the header.

Sources: IETF RFC 6797 (HTTP Strict Transport Security) and the HSTS preload list requirements published at hstspreload.org.

Check your own numbers

Confirm your certificate is valid before you turn HSTS on.

SSL CheckerCertificate issuer, validity window, days remaining and chain.

Frequently asked

Does HSTS replace a redirect from HTTP to HTTPS?

No, you need both. The redirect handles a first-time visitor whose browser has never seen the header; HSTS handles every visit after that, and removes the window in which an attacker on public Wi-Fi could intercept the unencrypted first request.

What value of max-age should I use?

Start small and raise it. Begin with a few minutes (max-age=300), then a day, then a week, then six months, and finally one year (31536000), checking that nothing breaks at each step. One year is also the minimum the preload list requires.

How do I turn HSTS off if something goes wrong?

You cannot recall it from browsers that have stored it. Serve the header with max-age=0 over valid HTTPS and each browser clears its entry the next time it visits, but browsers that do not come back keep the old value until it expires. This is why a long max-age should be set only after every subdomain is confirmed to support HTTPS.

What is the HSTS preload list?

A list of domains compiled into browsers, so HTTPS is enforced even on the very first visit. To be accepted, a site must serve a valid certificate, redirect HTTP to HTTPS on the same host, and send the header with max-age of at least one year, includeSubDomains and the preload token. Removal is possible but slow, because it has to reach new browser releases.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.