HSTS (HTTP Strict Transport Security)

HTTP Strict Transport Security (HSTS) is a response header, Strict-Transport-Security, that tells a browser to contact your domain only over HTTPS for a set period. After the first secure visit, the browser rewrites http:// requests to https:// itself, before any network request is made.

Why it matters

Without HSTS, the first request to http://example.com travels in plain text and relies on a redirect to reach HTTPS. An attacker on the same network can intercept that request (SSL stripping). HSTS closes the gap for every visit after the first, and it also makes users unable to click through certificate warnings on your site.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age is in seconds (31536000 is one year). includeSubDomains applies the rule to every subdomain. preload signals that you want to be added to the browser preload list, which requires a max-age of at least one year and includeSubDomains. Browsers ignore the header if it arrives over plain HTTP.

Common mistakes

• Setting a long max-age before every subdomain serves valid HTTPS. Any subdomain that cannot is unreachable for returning visitors until the timer expires.
• Adding preload casually. Removal from the preload list takes months to reach users, so treat it as close to permanent.
• Sending the header only on the redirect response instead of on the HTTPS response.
• Expecting HSTS to protect the very first visit. Only preloading does that.

Related

• SSL/TLS
• Redirect 301/302
• Content Security Policy
• गाइड: HSTS preload guide
• टूल: HSTS checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.