Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
Syntax
Strict-Transport-Security: max-age=<seconds>; includeSubDomains; preloadExample
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadDescription
The Strict-Transport-Security (HSTS) header tells browsers to only communicate with the server using HTTPS. Once received, the browser will automatically convert all HTTP requests to HTTPS for the specified duration.
The max-age directive specifies how long (in seconds) to enforce HTTPS. includeSubDomains extends this to all subdomains. preload allows inclusion in browser HSTS preload lists.
HSTS prevents man-in-the-middle attacks, SSL stripping, and cookie hijacking. Use at least 1 year (31536000 seconds) for production.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
63.0%
(317 of 503) send Strict-Transport-Security.
Most common values:
max-age=31536000— 66 sitesmax-age=31536000; includeSubDomains; preload— 53 sitesmax-age=31536000; includeSubDomains— 49 sites
See it on: yandex.ru, discord.com, github.com, habr.com, cloudflare.com
State of Web Security, November 2026: of 5,501 HTTPS home pages in the report,
- 58.2% send HSTS
- 44.8% max-age of a year or more
- 16.3% ready for the preload list
Check if your website sends this header correctly
Check your headers →