Glossary · Security

HSTS (HTTP Strict Transport Security)

HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.

Updated October 5, 2026

HTTP Strict Transport Security (HSTS) is a response header, Strict-Transport-Security, that tells a browser to contact your domain only over HTTPS for a set period. After the first secure visit, the browser rewrites http:// requests to https:// itself, before any network request is made.

Why it matters

Without HSTS, the first request to http://example.com travels in plain text and relies on a redirect to reach HTTPS. An attacker on the same network can intercept that request (SSL stripping). HSTS closes the gap for every visit after the first, and it also makes users unable to click through certificate warnings on your site.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age is in seconds (31536000 is one year). includeSubDomains applies the rule to every subdomain. preload signals that you want to be added to the browser preload list, which requires a max-age of at least one year and includeSubDomains. Browsers ignore the header if it arrives over plain HTTP.

Common mistakes

  • Setting a long max-age before every subdomain serves valid HTTPS. Any subdomain that cannot is unreachable for returning visitors until the timer expires.
  • Adding preload casually. Removal from the preload list takes months to reach users, so treat it as close to permanent.
  • Sending the header only on the redirect response instead of on the HTTPS response.
  • Expecting HSTS to protect the very first visit. Only preloading does that.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecuritySSL StrippingSSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by removing the redirect to HTTPS.Guide · SSL & SecurityHSTS Preload Guide: Requirements, Risks and How to SubmitLearn what the HSTS preload list is, the exact requirements, the risks of includeSubDomains, how to submit your domain safely, and why removal takes months.7 min readGuide · WordPressMove WordPress from HTTP to HTTPS: Complete SSL Migration GuideMigrate WordPress to HTTPS safely: install a certificate, update URLs with WP-CLI search-replace, fix mixed content, set 301 redirects and add HSTS.8 min readGlossary · SecurityHSTS Preload ListThe HSTS preload list is a list of domains built into browsers that must always use HTTPS, even on the first visit before any header is seen.Glossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.