HSTS stands for HTTP Strict Transport Security. It's an HTTP header your web server sends to browsers, instructing them to only connect to your site using HTTPS — never HTTP — for a specified period of time.

It closes a meaningful gap that HTTPS alone doesn't cover.

The problem HTTPS alone doesn't solve

Even if your site fully supports HTTPS, a user might type yourdomain.com without https://, or follow an old HTTP link. Their browser makes the initial request over HTTP — unencrypted — and gets redirected to HTTPS by your server.

That first HTTP request is a window for an SSL stripping attack: a man-in-the-middle intercepts the HTTP request and serves the user an HTTP version of your site. The user sees no padlock and their traffic is fully readable.

HSTS closes this window entirely.

How HSTS works

When a browser visits your HTTPS site and receives the HSTS header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

…it records that your domain should only ever be contacted over HTTPS. For the next year, if the browser tries to connect over HTTP for any reason, it upgrades the connection internally — before making any network request.

What the directives mean

  • max-age — how long the browser remembers the policy (31536000 = one year)
  • includeSubDomains — applies the policy to all subdomains too
  • preload — opts your domain into browsers' built-in HSTS lists, so HTTPS is enforced even on the very first ever visit

Before enabling HSTS

Make sure your entire site — including every subdomain — works correctly over HTTPS before adding this header. If a subdomain lacks a valid certificate and you've included includeSubDomains, visitors will see a browser error they cannot bypass.

threatprobe.app's free scan checks for the Strict-Transport-Security header — whether it's present, what max-age is set, and whether includeSubDomains is included.

Check your HSTS configuration →