HTTP Strict Transport Security (HSTS) lets a site tell browsers to reach it only over HTTPS. You send a Strict-Transport-Security header with a max-age value. Browsers then upgrade plain HTTP requests and refuse to let users click through certificate errors. It does not protect the very first visit.
What the header looks like
RFC 6797 gives these examples:
Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
max-age is required. It is the number of seconds, counted from receipt, that the browser treats the host as an HSTS host. A value of 0 tells the browser to delete the stored policy. includeSubDomains is optional and extends the policy to every subdomain.
Browsers ignore the header if it arrives over an insecure connection.
What the browser does with it
A known HSTS host gets its http requests rewritten to https before they leave the browser. If the secure connection has an error or warning, the browser must end the connection and the user cannot click through. That removes a common way attackers exploit users who accept bad certificates.
The first visit gap
The RFC calls it the bootstrap man in the middle vulnerability. A browser only learns the policy from a valid header on a secure connection. Until then, a plain http first contact is exposed.
Mitigations the RFC mentions: browsers shipping a preloaded list of HSTS sites, users manually declaring a domain, and servers redirecting http to https. OWASP's TLS guidance pairs HSTS with a permanent 301 redirect from port 80.
Rollout steps
- Make sure every page and subdomain you cover really works over HTTPS.
- Start with a short max-age, test, then raise it.
- Add includeSubDomains only when all subdomains, including forgotten ones, support HTTPS.
- Keep the HTTP to HTTPS redirect.
- Set the Secure flag on cookies, per OWASP.
- Watch certificate renewals. With HSTS a lapsed certificate means a hard failure for users. See TLS certificate lifetimes.
Browser preload lists have their own submission rules, which this post does not cover, so check the current requirements of any list before you commit.
A safe rollout example
A realistic path starts on a staging host. Send a short max-age and confirm every page works over HTTPS, including images, scripts and API calls, because mixed content that quietly worked before can now break. Move to production with the same short value and watch support tickets and error rates. Raise max-age in steps once nothing breaks. Add includeSubDomains last, after you have listed every subdomain, including marketing sites, old test hosts and vendor hosted pages on your domain, and confirmed each serves valid HTTPS. A single forgotten subdomain with an expired certificate becomes a hard failure for users who cannot click through.
Quick check
Can I undo HSTS?
Send max-age=0 over HTTPS. Browsers that see it delete the policy, but browsers that never revisit keep the old one until it expires, so start with short values.
Does HSTS encrypt anything itself?
No. It only forces HTTPS. Encryption comes from TLS.
Sources
Last reviewed: 19 October 2026.
