Strict-Transport-Security
HTTP Strict Transport Security (HSTS) tells browsers to only ever connect to your site over HTTPS. Once a browser sees the header, it refuses plain-HTTP requests to your domain for the duration of max-age — even if a user types http:// or clicks an insecure link.
Why it matters
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
How to add Strict-Transport-Security
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Recommended value
max-age=31536000; includeSubDomains; preloadAvoid
max-age=0 (disables HSTS) — or no header at allFrequently asked questions
What is a good max-age for HSTS?
One year (31536000 seconds) is the widely recommended value and is required for preload-list eligibility. Start smaller (e.g. 300) while testing, then raise it once you are confident every subdomain serves HTTPS.
Is the preload directive safe to add?
Only add preload once every subdomain is HTTPS-only and you intend to keep it that way. Preloading bakes your domain into browsers, and removal is slow — so treat it as a long-term commitment.
Does HSTS protect the first visit?
No. The browser must see the header at least once first. The HSTS preload list closes that gap by shipping your domain inside the browser so even the first request is forced to HTTPS.
Related reading
Other header guides
Why the X-Content-Type-Options: nosniff header matters, what MIME sniffing is, and how to set it in Nginx, Apache, and Cloudflare.
How X-Frame-Options prevents clickjacking, DENY vs SAMEORIGIN, why frame-ancestors supersedes it, and how to set it in Nginx, Apache, and Cloudflare.
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
How Referrer-Policy limits the referrer data sent to other sites, the safest values, and how to configure it in Nginx, Apache, and Cloudflare.
Is Strict-Transport-Security set on your site?
Scan any URL free to check Strict-Transport-Security and every other security header.
Scan Now - Free