Guides · HolicSecurity
What is HSTS, and should you turn it on?
Published 2 November 2026
In short: HSTS (HTTP Strict Transport Security) is a header that makes browsers use HTTPS for your domain automatically, for a period you choose. Turn it on once HTTPS works everywhere, ramp max-age up to one year, and think carefully before preloading.
The problem it solves
Even with a redirect from http to https, the first request a browser makes when someone types yoursite.com or follows an old http link goes out unencrypted. On a hostile network, an attacker can answer that request and keep the visitor on a fake http copy of the site: the "SSL stripping" attack. With HSTS, the browser remembers your instruction and upgrades the address itself, so the plain request never happens.
The header
Strict-Transport-Security: max-age=31536000; includeSubDomains- max-age: how many seconds the browser should remember. 31536000 is one year.
- includeSubDomains: applies the rule to every subdomain too.
- preload: optional; asks to be included in the list browsers ship with.
A safe rollout
- Make sure every page and subdomain loads over HTTPS with a valid certificate, and that certificates renew automatically.
- Send
max-age=300and test. - Raise to a week (604800), then a month (2592000), then a year (31536000).
- Add includeSubDomains once you've checked forgotten subdomains such as old mail, staging or vendor-hosted pages.
While HSTS is active, browsers won't let visitors bypass certificate errors on your domain. That's the point, but it means an expired certificate takes the site offline instead of showing a warning.
Preloading: think twice
Preloaded domains are HTTPS-only in Chrome, Firefox, Safari and Edge from the very first visit. Submission requires a one-year max-age, includeSubDomains, the preload directive and a redirect from http on the apex domain. Getting off the list takes months to reach users, so preload only if you're sure every subdomain, now and in future, will serve HTTPS.
Enabling it
Cloudflare: SSL/TLS, Edge Certificates, HTTP Strict Transport Security. Nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; in the HTTPS server block. Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". Netlify and Cloudflare Pages: a _headers file. Then confirm with our HSTS checker.
Free tool: HSTS checker
Free HSTS checker: read your Strict-Transport-Security header, max-age, includeSubDomains and preload, test the http to https redirect and see your hstspreload.org status..
Frequently asked questions
Does HSTS affect SEO?
Not directly. It strengthens HTTPS, which Google uses as a light ranking signal, and avoids an extra redirect for returning visitors.
How do I turn HSTS off?
Send max-age=0 over HTTPS. Browsers that see it forget the rule; others keep it until their stored max-age runs out.