What is HSTS?
HSTS (HTTP Strict Transport Security) is a response header that forces browsers to connect to a site only over HTTPS. HSTS protects against protocol-downgrade and cookie-hijacking attacks.
Why HSTS matters
Even a site that redirects to HTTPS starts every first visit with one insecure request, and that request is the opening an attacker on the same Wi-Fi needs to serve a fake page. HSTS closes it: once the browser has seen the header, it rewrites http:// to https:// internally for as long as max-age says, and it refuses to let the user click through certificate warnings for that host. Preloading goes further by shipping the domain in the browsers' built-in list, so even the first visit is protected.
The header is one line, but it is a commitment: with includeSubDomains every subdomain must be reachable over HTTPS for the whole max-age, and preloading is difficult to undo. Start with a short max-age, confirm nothing breaks, then raise it to a year.
Example
The production header, and the preload-eligible form:
Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadThe second line is required for hstspreload.org; only send it when every subdomain is HTTPS.
Common mistakes
- •A max-age of a few minutes, which offers almost no protection.
- •includeSubDomains with an HTTP-only internal subdomain that then stops working.
- •Sending HSTS over HTTP, where browsers ignore it.
How Webmatik checks it
The HSTS (HTTP Strict Transport Security) check reads the header on the audited pages and requires a max-age of at least six months to pass, reporting a shorter value as a warning.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit