What is HSTS?

HTTP Strict Transport Security (HSTS) is a response header, defined in RFC 6797, that tells a browser to load your site only over HTTPS for a set period. After the first secure visit, the browser upgrades any HTTP request itself, so visitors skip the insecure redirect and cannot be tricked into an unencrypted connection.

Why it matters

Redirecting HTTP to HTTPS is not enough on its own. The very first request may still travel over plain HTTP before the redirect happens, and that request can be tampered with on an untrusted network. With HSTS in place, a returning visitor's browser never sends that plain request.

The header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains

max-age is how many seconds the browser should remember the rule. 31536000 is one year.
includeSubDomains applies the rule to every subdomain, so each one must support HTTPS.
preload is an optional extra used to request inclusion in browsers' built-in list.

Browsers only accept the header when it arrives over a valid HTTPS connection.

How to check

Request your page and read the headers:

curl -sI https://example.com/ | grep -i strict-transport-security

If a line appears, HSTS is set. Check the max-age value.
In Chrome DevTools, open the Network panel, click the main document and look under Response Headers.
Test the home page, and any subdomains if you use includeSubDomains.

How to roll it out safely

First make sure HTTPS works on every page and every subdomain, and that the certificate renews automatically.
Start with a short max-age, such as 300 seconds, and confirm nothing breaks.
Raise it in steps, for example to a day, a week, then a year.
Add includeSubDomains only after checking all subdomains.
Add preload only if you understand the commitment; removal from the list can take a long time.

Common mistakes

Setting a one-year max-age before HTTPS is fully working, which can lock visitors out if the certificate expires.
Adding includeSubDomains while an old subdomain only supports HTTP.
Sending the header on HTTP responses, where browsers ignore it.
Joining the preload list without a plan to keep HTTPS running permanently.

Frequently asked questions

Does HSTS replace a redirect from HTTP to HTTPS?

No. Keep the redirect. HSTS only helps browsers that have already seen the header, so first-time visitors still rely on the redirect.

Is HSTS good for SEO?

It is a security measure. It does not promise a ranking change, but it supports a consistent HTTPS setup.

How do I undo HSTS?

Serve the header with max-age=0 over HTTPS, and browsers will clear the rule when they next visit. Preloaded sites need a separate removal request.

Crawvix's scan checks whether an HSTS header is present. To see yours, Try the free website sample.