How to enable HSTS (Strict-Transport-Security)
HSTS tells browsers to never load the site over plain HTTP again. One header, ideally with a long max-age and includeSubDomains.
Step by step, with screenshots: HSTS: enabling it safely and joining the preload list →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free SSL checker, the free Security headers checker or the free WordPress health check.
What it is
HSTS (HTTP Strict Transport Security) is a response header that tells browsers to use only HTTPS for your site for a set period. After a browser has seen it once, it turns every http:// link or typed address into https:// before sending anything, so no request travels unencrypted.
A typical header is Strict-Transport-Security: max-age=31536000; includeSubDomains, which lasts one year and covers subdomains. Without HSTS, the first request of a visit can still go out over HTTP, where an attacker on public Wi-Fi can intercept it and keep the visitor on an insecure connection. getReport flags a missing header and tells you whether it qualifies for the browser preload list, which needs a max-age of at least one year, includeSubDomains and preload.
What a passing site looks like
- Strict-Transport-Security header is setwarning · −2.5 ptseffort S
- HSTS is ready for the browser preload listinfo onlyeffort S
1. Strict-Transport-Security header is missing
Why it matters. HSTS tells browsers to always use HTTPS for your site, so after the first visit a typed address or an old http:// link never starts on an unencrypted connection. Only the preload list covers the very first visit.
- Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains.
- Start with a shorter max-age (e.g. 86400) if you are not sure every subdomain supports HTTPS.
In a report the technical detail reads: Response headers contained no strict-transport-security.
2. HSTS is not ready for the browser preload list
Why it matters. Browsers ship a built-in list of HTTPS-only sites; being on it protects even a visitor's very first request. To qualify, the header needs max-age of at least 31536000 s (1 year), includeSubDomains and preload.
- Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
- Submit the domain at hstspreload.org once every subdomain works over HTTPS.
Questions people ask
What is the HSTS header?
It is the Strict-Transport-Security response header, sent over HTTPS. max-age sets how many seconds browsers remember to use HTTPS only, includeSubDomains extends the rule to every subdomain, and preload signals that you agree to be added to browsers' built-in list. Browsers ignore the header when it arrives over plain HTTP, so send it on your HTTPS responses.
What does "HSTS missing from HTTPS server" mean?
It is a scanner finding that your HTTPS responses do not include a Strict-Transport-Security header. The site still works, but browsers are not told to insist on HTTPS, so a visitor who types your address or follows an old http:// link starts with an unencrypted request. Adding the header in your web server, CDN or hosting panel resolves it.
What is HSTS preload?
It is a list of HTTPS-only domains built into Chrome, Firefox, Safari and Edge, so even a visitor's very first request uses HTTPS. You apply at hstspreload.org once your header has a max-age of at least 31536000, includeSubDomains and preload, and every subdomain works over HTTPS. Removal takes months to reach all browsers, so check every subdomain before you apply.
Why does my browser say I cannot visit a site because it uses HSTS?
Because the site told your browser to accept only secure connections, and the connection failed a check, often because of an expired or mismatched certificate or a network that intercepts traffic. With HSTS, browsers remove the option to click through the warning. If it is your site, fix the certificate; visitors cannot bypass the error, which is exactly what HSTS is for.