HSTS Preload: 2026 Adoption Report

• HSTS preload blocks 100% of TLS stripping attacks from the first time the host is typed (no TOFU)
• A too-low max-age lets an attacker wait for it to expire and then strike
• includeSubDomains protects subdomains from MITM — critical for *.bank.example patterns
• Getting into the preload list is hard (requires ≥ 1 year max-age + includeSubDomains); getting out is also hard — removal takes 6+ months

Crawl of the top-10k Tranco (March 2026). Strict-Transport-Security header extracted via curl -I. max-age, includeSubDomains and preload directives parsed by regex. Presence in the preload list verified via hstspreload.org/api/v2/status?domain=X.

HSTS Preload is a critical security feature that forces browsers to communicate over HTTPS exclusively. As of 2026, global adoption is accelerating, with over 2,000 domains preloaded in major browsers like Chrome and Firefox. To add your domain, ensure it meets the requirements outlined at hstspreload.org. Key gotchas include misconfigurations, the necessity for a valid SSL certificate, and understanding the 18-month expiry rule for HSTS headers.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. The HSTS preload list is a collection of websites that enforce HSTS by default, which browsers reference to enhance security.

To successfully implement HSTS Preload for your domain, you must adhere to specific requirements:

• Valid SSL Certificate: Your site must be served over HTTPS with a valid SSL certificate.
• HSTS Header: You need to include the Strict-Transport-Security header in your server responses. The minimum configuration should look like this:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

This configuration specifies a max-age of at least one year, includes subdomains, and signals to browsers that your domain should be preloaded.

To check if your domain is correctly configured, you can use the following command:

curl -I https://yourdomain.com

If your HSTS header is correctly configured, you should see it in the response headers. Ensure your response includes the includeSubDomains directive for broader security coverage.

Once your configuration is in place, you can submit your domain to the HSTS preload list via hstspreload.org. Keep in mind that once preloaded, it can be challenging to remove your domain from the list, requiring a full cache clearance across browsers.

While implementing HSTS Preload can significantly enhance your website's security, there are several common pitfalls and gotchas that practitioners should be aware of to avoid service interruptions and security lapses.

• Incorrectly Configured HSTS Header: One of the most common issues is improperly setting the HSTS header. For instance, if you forget to include includeSubDomains, browsers will not enforce HSTS on your subdomains, potentially leaving them vulnerable.
• Non-HTTPS Content: After enabling HSTS, ensure all resources (images, scripts, etc.) are served over HTTPS. Mixed content can lead to security warnings and degraded user experience.
• SSL Certificate Expiry: If your SSL certificate expires, browsers will no longer enforce HSTS, which can lead to significant security risks. Regularly monitor your SSL certificate's status and renew it promptly.
• Testing in Local Environments: Developers often test websites in local environments without HTTPS. Remember that HSTS cannot be bypassed if a domain is preloaded, making local testing challenging. Use a staging environment with HTTPS enabled for testing.

For example, consider a scenario where a website is preloaded but has an expired SSL certificate. Users attempting to access the site will receive a security warning, and they may be discouraged from proceeding. To prevent this, implement regular checks using tools like SSL Labs to monitor certificate validity.

Another common mistake is failing to account for the 18-month expiry rule. If you decide to remove HSTS from your domain, you must wait 18 months for browsers to clear the preload cache. During this time, users will continue to be forced to connect via HTTPS, regardless of your current server configuration.

In summary, while HSTS Preload offers robust security benefits, careful attention to detail during implementation is crucial. Regular audits and monitoring of your HSTS settings, SSL certificates, and server configurations will help maintain a secure web environment.