# How to enable HSTS (Strict-Transport-Security)

> HSTS tells browsers to never load the site over plain HTTP again. One header, ideally with a long max-age and includeSubDomains.

Security · HTML version: https://getreport.app/learn/hsts

## HSTS header

Passing looks like: Strict-Transport-Security header is set.

**Why it matters.** HSTS tells browsers to always use HTTPS for your site, so after the first visit a typed address or an old http:// link never starts on an unencrypted connection. Only the preload list covers the very first visit.

**How to fix it.**

1. Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains.
2. Start with a shorter max-age (e.g. 86400) if you are not sure every subdomain supports HTTPS.

## HSTS preload readiness

Passing looks like: HSTS is ready for the browser preload list.

**Why it matters.** Browsers ship a built-in list of HTTPS-only sites; being on it protects even a visitor's very first request. To qualify, the header needs max-age of at least 31536000 s (1 year), includeSubDomains and preload.

**How to fix it.**

1. Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
2. Submit the domain at hstspreload.org once every subdomain works over HTTPS.

Check your own page: https://getreport.app/