What is HSTS?
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only ever connect to your site over HTTPS.
Why businesses care
It prevents downgrade and cookie-hijacking attacks that start from an insecure first request.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomainsHow to check
Look for the header in your site’s responses, or run the security headers checker.
How to fix
Add the header once every subdomain works over HTTPS. Begin with a short max-age.
Common mistakes
- Adding includeSubDomains before all subdomains support HTTPS
- Preloading without understanding it is hard to undo
Sources
Check it with Security Headers Checker
Check your site’s HTTP security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and get values to add.
Open Security Headers Checker