Glossary
SECURITY HEADERS

HSTS

HTTP Strict Transport Security — an HTTP response header telling browsers to only connect over HTTPS for a specified time. Blocks downgrade attacks.

HSTS (HTTP Strict Transport Security, RFC 6797) is an HTTP response header that instructs browsers to only use HTTPS for future connections to the domain, for a specified duration. It closes the last window in which an attacker on-path can downgrade a user from HTTPS to plaintext HTTP.

Header Format

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  • max-age — seconds the policy is remembered (63072000 = 2 years, the preload requirement)
  • includeSubDomains — apply the policy to every subdomain too
  • preload — flag your intent for HSTS preload list inclusion

HSTS Preload

Chrome, Firefox, Safari, and Edge ship a hard-coded list of domains that are HTTPS-only from the very first request — no visit needed. Submit at hstspreload.org after publishing the header with preload.

Common Miss

  • Publishing includeSubDomains before every subdomain has valid TLS (breaks the subdomains permanently for cached users)
  • Setting max-age=0 to disable — users who already cached the policy keep it until their max-age runs out
  • Not aligning max-age across CDN and origin

Use the security headers checker to validate your HSTS deployment.

Check the CSP glossary entry, read what an SSL certificate is, and browse the full HTTP security headers explainer.

← All terms Learning hub →