ASVS 5.0 requirement V3.7.4 says the application's top-level domain, such as example.com, must be added to the public HSTS preload list. That builds the use of TLS into the main browsers, instead of relying only on the Strict-Transport-Security header. It is a Level 3 requirement.
Why it matters
The HSTS header, covered in V3.4.1, protects a browser only after it has seen the header once. The very first visit, or the first after the policy expired, can still start over plain HTTP and be intercepted. Preloading ships your domain inside the browser itself, so even a first time visitor is forced onto HTTPS.
How to implement it
The preload list has strict conditions. Your site must serve a valid certificate, redirect HTTP to HTTPS on the same host, and serve all subdomains over HTTPS. The HSTS header on the base domain must look like this:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
The max-age must be at least one year and includeSubDomains and preload must both be present. Then submit the domain at the official site, hstspreload.org, which checks the header for you.
Prepare first:
- Inventory every subdomain, including internal, staging and forgotten ones. All must support HTTPS.
- Raise
max-agein steps and watch for breakage. - Treat preload as a long commitment. Removal is possible but takes months to reach users, because it depends on browser release cycles.
How to test it
curl -sI https://example.com | grep -i strict-transport-security
Confirm all three tokens and the max-age. Check the status of the domain at hstspreload.org, and check every subdomain over HTTPS with a valid certificate. In Chrome, chrome://net-internals/#hsts lets you query a domain and see whether it is preloaded.
Common mistakes
Preloading with an HTTP only subdomain. It becomes unreachable for preloaded browsers.
Setting the header only on www. Preload checks the base domain.
Submitting in a hurry. Removal is slow.
Quick check
Can I preload only a subdomain?
The list works on registrable domains with includeSubDomains, so the policy covers the whole domain.
Sources
- OWASP ASVS 5.0, requirement V3.7.4
- HSTS Preload List
