Security
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
Syntax
Strict-Transport-Security: max-age=<seconds>; includeSubDomains; preloadExample
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadDescription
The Strict-Transport-Security (HSTS) header tells browsers to only communicate with the server using HTTPS. Once received, the browser will automatically convert all HTTP requests to HTTPS for the specified duration.
The max-age directive specifies how long (in seconds) to enforce HTTPS. includeSubDomains extends this to all subdomains. preload allows inclusion in browser HSTS preload lists.
HSTS prevents man-in-the-middle attacks, SSL stripping, and cookie hijacking. Use at least 1 year (31536000 seconds) for production.
Check if your website sends this header correctly
Check your headers →