Skip to content
DomainVigil
Sign up

Reference guide

What is HSTS?

HSTS is one sentence your server says to the browser: from now on, and for a year, refuse to reach me over anything but HTTPS. It works, and it is very hard to take back.

8 min readUpdated September 12, 2026

In short

HSTS is an HTTP header telling the browser never to reach a site over plain HTTP again for a set period. The browser remembers it: even if the visitor types an HTTP address, the request is rewritten to HTTPS before it ever leaves their machine. The header is only honoured when it arrives over a valid HTTPS connection.

What HSTS is for

Redirecting HTTP to HTTPS is not enough. Between the moment a visitor types your address and the moment the redirect reaches them, one request has already gone out in the clear. That is the opening an attacker needs: answer in the site's place, and make sure the redirect never arrives.

HSTS closes that window for every later visit. The browser remembers the instruction and rewrites the address itself before opening any connection: nothing leaves in the clear, even when the visitor clicks an old HTTP link. It also stops the visitor clicking through a certificate warning, where it would normally offer to continue.

The downside matches. A one-year instruction is a one-year promise, stored on your visitors' machines, that you cannot revoke from your end. Break your HTTPS after setting HSTS and the site is unreachable, with no way round it, for everyone who has already been there.

The header, term by term

One line, sent with every HTTPS response from the site. Where it sits matters as much as what it says.

HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains; preload

  1. strict-transport-securityThe header name

    Only honoured on a response served over HTTPS with no certificate error. Sent on a cleartext response it is ignored — the number one reason a rollout does nothing.

  2. max-age=31536000The duration, in seconds

    Required. One year here. The counter restarts at every visit, so a regular visitor stays covered permanently.

  3. includeSubDomainsExtension to every subdomain

    Applies the rule to everything under the name, including subdomains created later. This is the directive that knocks out an internal tool still served over HTTP.

  4. preloadThe request to join the built-in list

    Does nothing on its own: it signals that you accept being included in the list shipped with browsers. Joining is requested separately.

HSTS directives and their effects

One required directive, two optional ones, and two behavior rules the tutorials leave out — which is why so many rollouts do nothing.

DirectiveWhat it doesWorth knowing
max-age=31536000Sets how long the browser will refuse HTTP for this name. One year here.Required. Without it, the whole header is ignored.
max-age=0Erases the stored instruction for this name.The only way back, and it only reaches visitors who return to see the new response.
includeSubDomainsExtends the rule to every subdomain, present and future.Only switch it on after a full inventory: a single subdomain still on HTTP becomes unreachable.
preloadDeclares that you are asking to join the list built into browsers.Not part of the standard: it is a browser requirement, not a protocol one.
Header received over plain HTTPNothing: the browser ignores it entirely.Setting it on the redirect response has no effect. It has to be on the HTTPS response.
Header received with an invalid certificateNothing either: the instruction is not stored.So a broken certificate blocks both setting HSTS and, once it is set, reaching the site at all.

Check your own domain, right now

Enter a domain name: the tool reads its certificate, its validity and the authority that issued it — the foundation without which HSTS is pointless.

No sign-up, no email required. You can paste a full address — we'll pull the domain out of it.

The rollout staircase

Set a year straight away and you have signed up for a year without testing. The five steps take a few weeks, and every one stays reversible until the last.

  1. 1

    Serve the whole site over HTTPS

    Including subdomains, internal tools, old addresses and images called from other sites. That is the inventory, and it is the longest step.

  2. 2

    Set a very short duration

    Five minutes. If something breaks, the instruction clears itself before the meeting is over.

    max-age=300

  3. 3

    Move to a day, then a week

    Each level gives whatever the inventory missed time to surface, with no commitment to the next.

    max-age=86400 → max-age=604800

  4. 4

    Move to a year

    The steady-state value. From here, reversing no longer takes a day: you have to serve a zero duration and wait for every visitor to come back.

    max-age=31536000

  5. 5

    Extend to subdomains, then ask for the list

    These last two steps are only for those who know what they are signing: the built-in list protects from the very first visit, and leaving it takes months.

The built-in list: what it requires, what it costs

HSTS does not protect the very first visit from a browser that has never seen the site. The list shipped with browsers settles that case — at the price of a commitment that cannot be undone in an afternoon.

ConditionWhat it requiresWhy
Valid certificateA trusted certificate on the domain and on every subdomain.Joining assumes HTTPS already works everywhere, without exception.
Redirect from HTTPHTTP on the same name must redirect to HTTPS on the same name.Redirecting to a different name first breaks the check.
Subdomains over HTTPSAll of them, including the ones that are not public.Joining forces the extension to subdomains: anything left on HTTP goes unreachable.
Header on the rootA duration of at least a year, the extension to subdomains, and the joining keyword.It is the proof the commitment is being held over time, not just tested once.
LeavingA request, then waiting for a new release of every browser.Count several months before devices stop applying the instruction. Worth knowing before joining, not after.

Rollout mistakes

  • The header is set and nothing happens

    What causes it: It is sent on the cleartext redirect response rather than on the HTTPS response. The browser ignores it, as the standard requires.

    What fixes it: Set it on responses served over HTTPS. Check with a tool that shows the real headers, not from the server configuration.

  • A subdomain suddenly becomes unreachable

    What causes it: The extension to subdomains was switched on while an internal tool, an old interface or a development service was still served over HTTP.

    What fixes it: Remove the extension, take a full inventory of subdomains, move them all to HTTPS, then switch it back on. Meanwhile, visitors already covered stay locked out.

  • You want to reverse course and cannot

    What causes it: The one-year instruction lives on your visitors' machines. Nothing you do on the server erases it remotely.

    What fixes it: Serve a zero duration over HTTPS and wait for each visitor to return. Only those who return see the new instruction — the rest stay on the old one until it runs out.

  • The certificate expires and the site becomes completely unreachable

    What causes it: HSTS stops the visitor clicking through the certificate warning. What would normally be a warning screen becomes a wall.

    What fixes it: Treat certificate expiry as a major outage as soon as HSTS is live, and watch the date from outside rather than on the server.

The questions that come next

Does HSTS replace the HTTP to HTTPS redirect?

No — it backs it up. The redirect is still essential for the very first visit, the one where the browser has stored nothing yet. HSTS covers everything after that.

What duration should I pick?

A year in steady state, but never straight away. Climb in stages: five minutes, a day, a week, then a year. Each stage lets you find what the inventory forgot while it is still reversible.

Should I ask to join the built-in list?

Only if HTTPS is settled everywhere and for the long run, subdomains included. The gain covers one case, the first visit from a new browser; the cost is a commitment that takes months to leave.

Does HSTS protect against everything?

No. It guarantees the connection is made over HTTPS and that no warning can be clicked past. It says nothing about what the page contains, nor about the certificate beyond the system recognizing it.

With HSTS, an expired certificate is no longer a warning

It is a wall: the visitor cannot click through, and the site is simply unreachable. DomainVigil watches the certificate on every domain you own from outside, and warns you well before the deadline.

Start for free

Five domains free, forever. No card required.

The other reference guides