HTTP Strict Transport Security (HSTS) is a response header a website sends to tell browsers: never connect to this domain over plain HTTP again — always use HTTPS, even if the user types http:// or clicks an old http:// link.

The problem it solves

Without HSTS, even a site that fully supports HTTPS is briefly vulnerable the moment a user's very first connection happens over plain HTTP (before any redirect to HTTPS occurs) — an attacker positioned on the network (e.g. a malicious public Wi-Fi hotspot) can intercept that first plaintext request. HSTS closes this gap by having the browser itself refuse to attempt an HTTP connection at all, for every subsequent visit, without needing to trust a redirect that could itself be intercepted.

Reading the header

A typical HSTS header looks like:

`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`

  • max-age — how many seconds the browser should remember to enforce HTTPS-only for this domain (31536000 seconds = 1 year is common).
  • includeSubDomains — extends the rule to every subdomain, not just the exact domain that sent the header.
  • preload — a request to be included in browsers' built-in HSTS preload list, so even a user's very first-ever visit is protected, before the header has ever been received.

A genuine risk to know about

Because the `preload` directive can be very hard to reverse (browsers ship it baked into their own release, not something a single header change can instantly undo), enabling it deserves real confidence HTTPS is correctly and permanently configured across the entire domain and all subdomains first.

How to check it yourself

Our HSTS Checker shows whether a site sends the header at all, and if so, its exact max-age, includeSubDomains and preload values.