Strict-Transport-Security Header: Syntax and Examples

How Strict-Transport-Security works

After seeing it over HTTPS, the browser rewrites every http:// URL for the domain to https:// before sending, and refuses to let users click through certificate errors. That closes the gap where the first plain-HTTP request can be intercepted. The header is ignored when sent over plain HTTP.

Directives

Value	Meaning
`max-age=<seconds>`	How long to remember. One or two years (31536000 or 63072000) is typical.
`includeSubDomains`	Applies to every subdomain too. Make sure they all serve HTTPS first.
`preload`	Signals consent to be built into browsers’ preload list (submit at hstspreload.org). Hard to undo.

Examples

Start small while testing

Strict-Transport-Security: max-age=300

Full deployment

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Common mistakes

Removing HSTS takes effect only after max-age runs out for each visitor; max-age=0 clears it for browsers that see it. Ramp up slowly.

Check it

curl -sI https://example.com | grep -i '^strict-transport-security:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Content-Security-Policy: restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
X-Forwarded-Proto: tells the application whether the client connected over HTTPS or HTTP, when TLS ends at a proxy.
Location: gives the URL to redirect to (with 3xx) or of a newly created resource (with 201).

More security headers

X-Content-Type-Options , X-Frame-Options , Referrer-Policy , Permissions-Policy , Cross-Origin-Opener-Policy , Cross-Origin-Embedder-Policy , Cross-Origin-Resource-Policy .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Strict-Transport-Security header do?

The Strict-Transport-Security response header tells browsers to use only HTTPS for this site, for a given time (HSTS). After seeing it over HTTPS, the browser rewrites every http:// URL for the domain to https:// before sending, and refuses to let users click through certificate errors. That closes the gap where the first plain-HTTP request can be intercepted. The header is ignored when sent over plain HTTP.

How do I see the Strict-Transport-Security header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.