๐ HSTS Header Builder
Strict-Transport-Security: max-age=31536000; includeSubDomains
Build a Strict-Transport-Security (HSTS) header, which tells browsers to always connect to your site over HTTPS, by setting the max-age duration and the includeSubDomains and preload options.
How to use
- Enter the max-age (in seconds) โ how long browsers should remember this policy.
- Enable includeSubDomains if the policy should also apply to subdomains, and preload if you plan to submit the site to the browser preload list.
- The assembled HSTS header string is shown automatically.
FAQ
What is Strict-Transport-Security?
It's an HTTP response header defined by RFC 6797. Once a browser receives it, that browser automatically upgrades all future connections to the site to HTTPS for the specified duration, preventing man-in-the-middle downgrade attacks to plain HTTP.
What value should I use for max-age?
It's the number of seconds the browser should remember this setting. 31536000 (one year) is common, but it's recommended to start with a short value for testing and gradually increase it once you've confirmed everything works over HTTPS.
What does the preload option do?
preload signals intent to be added to the HSTS preload list built into major browsers, which forces HTTPS from a visitor's very first request โ even before they've seen your header. Actual inclusion requires a separate submission and review process, and removal from the list afterward can take a long time, so enable it with that in mind.