What is HSTS?

HSTS, short for HTTP Strict Transport Security, is a security header that forces browsers to connect to your website only over HTTPS. Once a browser has seen the HSTS header, it will refuse to load your site over plain, unencrypted HTTP, even if a visitor types the address without https or follows an old http link. It is a small header with an outsized impact on how safely people reach you, and it is one of the first things a good security scan looks for.

What problem does HSTS solve?

Redirecting HTTP to HTTPS is good practice, but on its own it leaves a gap. The very first request a browser makes still travels over insecure HTTP before your redirect can send it to the secure version. An attacker sharing the same network, for example on public Wi-Fi, can intercept that first request and quietly keep the victim on HTTP while relaying traffic to your real site. This is called SSL stripping, and to the visitor nothing looks wrong. HSTS removes the gap entirely. After the first secure visit, the browser remembers your policy and upgrades every future request to HTTPS on the device itself, before a single byte reaches the network.

How the HSTS header works

You enable it by sending the Strict-Transport-Security response header over an HTTPS connection. The header has three parts that together define the policy:

• max-age is the number of seconds the browser should keep enforcing HTTPS for your domain. A common production value is 31536000, which is one year.
• includeSubDomains extends the policy to every subdomain, closing gaps on asset hosts, apps and staging servers that might otherwise be reached over HTTP.
• preload signals that you want your domain built directly into browsers, so HTTPS is enforced even on a visitor’s very first connection.

A typical production header reads Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Browsers refresh the countdown on every visit, so an active site effectively stays protected indefinitely.

The HSTS preload list

Major browsers ship with a built-in preload list of domains that must always use HTTPS. Getting your domain onto that list means visitors are protected from their very first connection, with no insecure request at all, not even once. Preloading is powerful, but it is also hard to reverse quickly, because the entry is baked into browser releases. Only submit your domain once every subdomain reliably serves HTTPS and you are confident you will not need to serve anything over plain HTTP for a long time.

Does HSTS replace your HTTPS redirects?

No. You still need a server-side redirect from HTTP to HTTPS, because a brand-new browser that has never visited you has not yet seen the HSTS header. Think of the redirect as the mechanism for the first visit and HSTS as the guarantee for every visit after that. Used together, they make an accidental insecure connection almost impossible for returning visitors, and preloading extends that guarantee to first-time visitors too.

Common HSTS mistakes

• A tiny max-age such as a few minutes, which offers almost no real protection.
• Adding includeSubDomains before every subdomain supports HTTPS, which can take working subdomains offline.
• Sending the header over HTTP, where browsers correctly ignore it and the policy never activates.
• Preloading too early and then being unable to back out for months when something needs HTTP.

How to check your HSTS header

Because HSTS is invisible to visitors, the only way to know it is set correctly is to inspect your response headers directly. Run a security scan with EzyAudit AI and you will see whether the Strict-Transport-Security header is present, whether max-age is long enough to matter, and whether includeSubDomains and preload are configured sensibly for your setup. If the scan reports a problem, our guide on how to fix HSTS errors walks through the corrections. You can see every header we grade on the features page. For the formal specification, HSTS is defined in IETF RFC 6797.

Enabling HSTS is one of the simplest ways to guarantee the encryption you already paid for is actually used. Scan your website now to confirm your HSTS header is doing its job.