Guide
HSTS: forcing HTTPS and getting on the preload list
When a visitor types example.com into a browser, the first request usually goes out over plain HTTP, and a redirect to HTTPS follows. That first hop can be hijacked by anyone on the network, for instance on public Wi-Fi, who can strip the redirect and keep the user on an unencrypted connection. HTTP Strict Transport Security, defined in RFC 6797, closes that gap: once a browser has seen the header from a site over a valid HTTPS connection, it uses HTTPS for that site by itself.
The three parts of the header
max-age is how long, in seconds, the browser remembers the rule. includeSubDomains extends the rule to every subdomain, including ones you forgot. preload signals that you want the domain included in the list shipped with browsers, which protects even the very first visit. The generator shows presets from five minutes, for a first test, through a day, a week, 30 days and 180 days, to one year, which is the minimum for preload, and two years, recommended once everything is stable.
A worked example
The Sample button selects the preload-ready header: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, where 63,072,000 seconds is two years. Pasted back into the check box, it passes: “The header meets the technical requirements for the HSTS preload list.” The preload checklist lists five items. Good: max-age is at least one year, since 63072000 exceeds the 31,536,000 minimum. Good: includeSubDomains is present. Good: the preload directive is present. A medium note warns that preloading is hard to undo, and another note says what the page cannot check, namely valid certificates for the domain and every subdomain, an HTTP to HTTPS redirect on the same host, and the header on the redirect response.
Rolling it out
Order matters because HSTS makes mistakes costly. First make sure every page and subdomain works over HTTPS with a valid certificate, and that nothing important still depends on HTTP. Then send a short max-age, watch for broken pages, and raise it in steps. Add includeSubDomains only after listing every subdomain, including internal tools and forgotten test hosts, since they will refuse plain HTTP. Preload last.
Preload in practice
Submit a qualifying domain at hstspreload.org, which tests the live site. Browsers adopt the list in their release cycle, so inclusion takes weeks to months to reach all users, and removal takes as long. A domain on the list cannot serve plain HTTP, even for a moment, without breaking for visitors. That is why the generator marks preload as a commitment and not a switch to try.
Common mistakes
Sending the header only on the HTTP redirect, where it is ignored. Setting max-age=0, which tells browsers to forget the rule; useful for backing out, and not for normal operation. Forgetting that the header must also be on the base domain, not only on www. Expecting HSTS to fix mixed content, which it does not: it affects navigation, and sub-resources still need https:// references.
Limits
The page checks the header text and builds server configuration. It cannot test your live site, redirects or certificates. Settings are built in your browser and nothing is sent.
Related tools
- Security Headers Generator and Auditor grades HSTS together with other headers.
- Mixed Content Scanner finds http:// references that remain on HTTPS pages.
- SSL Certificate Decoder checks the certificate that HSTS depends on.
- CSP Generator and Evaluator can add upgrade-insecure-requests for sub-resources.
Checked against the current version of the HSTS Header Generator on .