Glossary · Security

HSTS Preload List

The HSTS preload list is a list of domains built into browsers that must always use HTTPS, even on the first visit before any header is seen.

Updated November 4, 2026

The HSTS preload list is a list of domains shipped inside browsers that are treated as HTTPS-only from the very first request. Unlike the plain Strict-Transport-Security header, which a browser can only learn after one secure visit, a preloaded domain is protected from the start.

Why it matters

The ordinary header leaves a gap on first contact and after the stored policy expires. Preloading closes it. The list is maintained at hstspreload.org and used by major browsers. To qualify, you serve a valid certificate, redirect HTTP to HTTPS on the same host, serve HTTPS on all subdomains, and send an HSTS header on the root domain with a max-age of at least one year plus includeSubDomains and preload.

Example

Header that meets the submission rules:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Then submit the domain at hstspreload.org. Removal is possible but slow, because it only takes effect when browsers ship new versions.

Common mistakes

  • Submitting before auditing every subdomain, including forgotten internal and staging hosts.
  • Treating the submission as a setting you can undo this week.
  • Adding preload to the header and assuming the domain is on the list. You still have to submit it.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecuritySSL StrippingSSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by removing the redirect to HTTPS.Guide · SSL & SecurityHSTS Preload Guide: Requirements, Risks and How to SubmitLearn what the HSTS preload list is, the exact requirements, the risks of includeSubDomains, how to submit your domain safely, and why removal takes months.7 min readGuide · WordPressMove WordPress from HTTP to HTTPS: Complete SSL Migration GuideMigrate WordPress to HTTPS safely: install a certificate, update URLs with WP-CLI search-replace, fix mixed content, set 301 redirects and add HSTS.8 min readGlossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.