Security · Response header
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
What is Strict-Transport-Security?
HSTS instructs browsers to upgrade all future requests to the domain to HTTPS, preventing SSL stripping and cookie interception on public Wi-Fi.
Typical usage
Set on production HTTPS sites. Consider `preload` for the HSTS preload list.
Examples
Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadCommon gotchas
Once set, browsers refuse to visit the site via HTTP for the max-age duration — a broken HTTPS cert becomes an outage. Start with a short max-age and grow.
Specification
RFC 6797
Frequently asked questions
What is the Strict-Transport-Security HTTP header?
HSTS instructs browsers to upgrade all future requests to the domain to HTTPS, preventing SSL stripping and cookie interception on public Wi-Fi.
Is Strict-Transport-Security a request or response header?
Strict-Transport-Security is a response header — the server sends it to the client. Set on production HTTPS sites. Consider `preload` for the HSTS preload list.
What does a Strict-Transport-Security header look like?
A typical Strict-Transport-Security header looks like: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
What are common mistakes with Strict-Transport-Security?
Once set, browsers refuse to visit the site via HTTP for the max-age duration — a broken HTTPS cert becomes an outage. Start with a short max-age and grow.
Related headers
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.
Permissions-Policy
Controls which browser features and APIs pages can use.