HSTS

HSTS tells browsers to use HTTPS for a site for a fixed period, blocking protocol downgrade and cookie-hijacking attacks after the first successful response.

security

Definition

HTTP Strict Transport Security is a response header policy that instructs a browser to replace insecure HTTP requests for a host with HTTPS for a configured duration. It can cover subdomains and be preloaded into browsers so the policy applies before the first visit.

Context and scope

HSTS protects users after the first successful HTTPS response and is recommended for all public sites. It is especially important for cookie-authenticated applications and works alongside TLS, redirects, and secure cookie attributes.

Common misconceptions

HSTS protects the very first visit to a domain without preloading
Removing the header immediately disables the policy in browsers that already received it

Anti-patterns

Enabling includeSubDomains before every subdomain supports HTTPS
Submitting a domain to preload without a long-term commitment to HTTPS

Related concepts

Related examples

Authoritative source

https://www.rfc-editor.org/rfc/rfc6797

How HSTS works

A server sends Strict-Transport-Security over HTTPS. The browser records the policy for max-age seconds and rewrites future http:// navigations to https:// before sending anything. includeSubDomains extends the rule to every subdomain, and preload submits the domain to browser-built lists so the policy applies on the very first visit.

When to use it

Enable HSTS on every public HTTPS site after confirming that all subdomains support HTTPS and that redirects are correct. Preload only when the domain and its subdomains are permanently HTTPS-ready, because removal takes months and depends on browser updates. HSTS is especially valuable for sites that set cookies, since it prevents cookie leakage over plaintext requests.

Trade-offs

HSTS is intentionally sticky. A mistaken max-age or an expired certificate can lock users out with no click-through, and browsers may ignore the “proceed anyway” option. Internal hostnames that share a preloaded parent domain can break. Start with a short max-age, verify, then raise it. HSTS does not replace a valid certificate, and it does not protect the first request unless the domain is preloaded. Compared with a plain HTTP redirect, HSTS removes the insecure round trip once the policy is stored.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Send the header only on HTTPS responses. Pair it with a 301 redirect from HTTP to HTTPS and keep that redirect for clients that do not support HSTS, including some command-line tools.

HSTS does not encrypt anything by itself; TLS does. It does not hide the hostname from observers and does not apply to non-HTTP protocols. Removing the header does not immediately undo the policy for browsers that already stored it. Use it with TLS, CSP, and secure cookie attributes as part of defense in depth.