HSTS: How to Enable HTTP Strict Transport Security (And Why You Should)

Without HSTS, a user typing 'yourdomain.com' into their browser makes an initial HTTP request — even if your server immediately redirects to HTTPS. During that brief HTTP request window, an attacker on the same network can intercept and strip the SSL, serving the user an HTTP version of your site.

HSTS tells browsers: 'For this domain, always use HTTPS — skip the HTTP step.' After the first visit, the browser never makes an HTTP request to your domain for the duration of the max-age period.

Add this response header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age=31536000 means 1 year (in seconds). includeSubDomains applies protection to all subdomains. preload opts you in to browser preload lists (see below).

HSTS has one vulnerability: the first visit. Before a browser has seen your HSTS header, it still makes an HTTP request. The HSTS preload list solves this by hardcoding your domain as HTTPS-only in Chrome, Firefox, Safari, and Edge — even for first-time visitors.

To join the preload list: enable HSTS with includeSubDomains and preload, then register at hstspreload.org. Warning: this is difficult to undo — all subdomains must support HTTPS before you register.