What is HSTS?

HSTS, explained

The header looks like Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. MDN describes the directives: max-age is how many seconds the browser remembers the policy, includeSubDomains applies it to every subdomain, and preload signals that you want the domain included in browsers' built-in preload lists. Preloading requires a max-age of at least one year and includeSubDomains.

Browsers only honor the header when it arrives over HTTPS. After that, for the duration of max-age, they rewrite any HTTP request to your domain to HTTPS internally, and they won't let users click through certificate errors. In Chrome's network panel you'll see this as a "307 Internal Redirect", which never reaches your server. The first visit before the browser has seen the header isn't protected, which is the gap the preload list closes.

For SEO, HSTS isn't a ranking signal on its own, but it's part of doing HTTPS properly, and Google's 2014 HTTPS announcement recommended it. It removes a redirect hop for returning visitors and prevents downgrade attacks.

Be careful with scope. MDN warns that once includeSubDomains is set, the policy is hard to walk back: it persists in browsers until it expires, and can only be cleared early with max-age=0 served over HTTPS. If any subdomain, like an old marketing tool or a staging server, can't serve HTTPS, it will break for visitors. Start with a short max-age, confirm everything works, then increase it.

Why it matters for founders

HSTS is a one-line security header that makes your HTTPS setup complete. The risk is setting it too broadly before every subdomain supports HTTPS.

Example

You add Strict-Transport-Security: max-age=300 for a week, confirm nothing breaks, then raise it to two years with includeSubDomains once every subdomain serves HTTPS.

Common mistakes

• Preloading before every subdomain supports HTTPS.
• Starting with a two-year max-age on day one.
• Sending the header over HTTP, where browsers ignore it.
• Mistaking the browser's 307 internal redirect for a server redirect.