Strict-Transport-Security (HSTS)
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
max-age=63072000; includeSubDomains; preloadProduction Server Implementation
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;Directives & Syntax Breakdown
Duration in seconds (2 years) the browser must remember to force HTTPS for this domain.
Applies the HTTPS enforcement rule to all subdomains (api., mail., dev., etc.).
Consents to inclusion in Google Chrome and major browsers permanent hardcoded HSTS preload list.
Common Security Hazards & Pitfalls
- •Never send HSTS on plain HTTP responses. Browsers ignore HSTS over HTTP for security reasons.
- •Only add "preload" if all subdomains permanently support valid SSL/TLS certificates.
Strict-Transport-Security (HSTS) - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
Once your domain serves HSTS with max-age >= 31536000, includeSubDomains, and preload, submit it at hstspreload.org.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.