Security · Response header

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

What is Strict-Transport-Security?

HSTS instructs browsers to upgrade all future requests to the domain to HTTPS, preventing SSL stripping and cookie interception on public Wi-Fi.

Typical usage

Set on production HTTPS sites. Consider `preload` for the HSTS preload list.

Examples

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Common gotchas

Once set, browsers refuse to visit the site via HTTP for the max-age duration — a broken HTTPS cert becomes an outage. Start with a short max-age and grow.

Specification

RFC 6797

Related headers

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

X-Frame-Options

Prevents clickjacking by controlling framing.

X-Content-Type-Options

Disables MIME-type sniffing.

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

Permissions-Policy

Controls which browser features and APIs pages can use.