HSTS (Strict-Transport-Security) Header

Tells browsers to only ever connect to your site over HTTPS, for a set period of time, without waiting for a redirect.

Last updated August 9, 2026.

Severity when missing: Medium — see the missing-header finding on the security headers checker.

What it does

HTTP Strict Transport Security (HSTS) is a response header that instructs a browser to remember, for a given max-age, that it should never load the site over plain HTTP. Once a browser has seen the header, it rewrites any future http:// request to https:// internally, before a single byte goes over the network.

Why it matters

Without HSTS, every visit starts as a plain HTTP request that your server then redirects to HTTPS. That first request is a window: an attacker on the same network (a coffee-shop Wi-Fi, a compromised router) can intercept it and strip the redirect, keeping the victim on HTTP indefinitely — a classic SSL-stripping attack. HSTS closes that window by making the browser skip HTTP entirely on repeat visits, and the `preload` directive lets you close it on the very first visit too, by getting the domain baked into browsers' shipped preload lists.

Example header

Example only — this is not evidence from a live scan.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

How to test for it

Load the site once over HTTPS, then inspect the response headers in your browser's network panel or with `curl -sI https://example.com` and look for a `Strict-Transport-Security` line.
Check `max-age` is a meaningful duration — 31536000 seconds (one year) is the common baseline for production sites.
If you intend to submit the domain to the HSTS preload list, check the submission requirements first: `max-age` of at least 31536000, both `includeSubDomains` and `preload` present, HTTP redirecting to HTTPS on the same host, and every subdomain actually serving HTTPS. Preloading is slow and awkward to undo, so confirm all of it before submitting.

How to add it

Deploy this one in stages. `includeSubDomains` applies the HTTPS-only rule to every subdomain, including any that still serve plain HTTP — an internal tool, a legacy staging host, a vendor-hosted subdomain — and browsers honour it for the full `max-age` with no way for you to revoke it early. Start with a short `max-age` (300 seconds), confirm the apex and every subdomain serve HTTPS correctly, then raise it to 31536000. Add `preload` and submit the domain only after that, because removal from the preload list ships on browser release cycles and takes months.

Nginx

add_header Strict-Transport-Security "max-age=300; includeSubDomains" always;  # raise to 31536000, then add preload, once every subdomain is verified on HTTPS

Apache

# raise to 31536000, then add preload, once every subdomain is verified on HTTPS
Header always set Strict-Transport-Security "max-age=300; includeSubDomains"

Cloudflare

SSL/TLS → Edge Certificates → enable "Always Use HTTPS" and the HSTS toggle (sets the header at the edge; review the max-age, subdomains and preload options in that panel before enabling preload).

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guides Website security scanner

FAQ

What is HSTS?

HSTS (HTTP Strict Transport Security) is a response header that tells a browser to only ever connect to a domain over HTTPS, for a set period of time, without needing a redirect first. It stops the first-visit window where an attacker could intercept an initial HTTP request before the redirect to HTTPS happens.

What's the difference between HSTS and an HTTP-to-HTTPS redirect?

A redirect still makes a first, unprotected HTTP request that an attacker on the network can intercept or alter before it ever reaches your server. HSTS removes that request entirely — once a browser has seen the header, it rewrites HTTP requests to HTTPS internally, before anything goes over the network.

What does the includeSubDomains directive do?

It extends the HSTS policy to every subdomain of the domain that sent the header, not just the exact host. Without it, an attacker could still target a subdomain that hasn't independently sent its own HSTS header.

What is HSTS preload, and do I need it?

Preloading bakes your domain into a list shipped directly in browsers, so the very first connection — before any header has ever been seen — is already forced to HTTPS. It requires max-age of at least a year, includeSubDomains, and the preload directive, and submission is effectively permanent to reverse. Most sites get sufficient protection from the header alone; preload is for domains that need first-connection coverage.

What's a safe max-age value for HSTS?

31536000 seconds (one year) is the standard baseline, and is required for preload list submission. Rolling it out gradually with a shorter value first, then raising it once you've confirmed HTTPS works everywhere on the domain, avoids locking out a subdomain that still needs plain HTTP.

Standards reference

RFC 6797 — HTTP Strict Transport Security (HSTS). For exactly how Nivaronix evaluates this header during a scan, see the methodology page.