Beamfar
Sign inStart the 14-day trial

What is HSTS (HTTP Strict Transport Security)?

Last updated .

HSTS (HTTP Strict Transport Security) is a mechanism, defined in RFC 6797, by which a website declares that browsers should reach it only over secure connections. The site sends the Strict-Transport-Security header over HTTPS, and the browser remembers the rule for the number of seconds given in max-age.

Definition
HSTS
A response header that tells browsers to reach a site only over HTTPS for a stated time, with no click-through on certificate errors.

The directives

max-age is required and sets how long the browser keeps the rule; zero removes it. includeSubDomains extends the rule to every subdomain, which is the setting that surprises people: a forgotten subdomain without HTTPS becomes unreachable.

Why agencies should care

HSTS is good practice, and it changes what a certificate problem looks like. RFC 6797 requires a browser to end the connection on any secure transport error, certificate validity included, and recommends giving users no way to override it. On a site that sends HSTS, an expired certificate is therefore a hard outage for returning visitors, not a warning they can click past.

An example

Strict-Transport-Security: max-age=31536000; includeSubDomains tells browsers to use only HTTPS for that host and all its subdomains for a year. On a new site start with a short max-age such as 300 seconds, confirm that every subdomain works over HTTPS, then raise it. Preloading is a separate step: the site sends preload and is submitted to browsers’ built-in list, and leaving that list can take months, so wait until HTTPS is permanent everywhere.

What to check

That the header is present on the main host with a sensible max-age, that every subdomain covered by includeSubDomains really serves HTTPS and that certificate renewal is monitored.

Sources

Read on . Standards and vendor pages change; confirm the current text before you rely on it.

Guides that use this term

  • TLS certificateA TLS certificate proves that a website holds the name in the address bar and enables HTTPS. What it contains, how long it lasts and what happens when it expires.
  • Certificate authorityA certificate authority is an organisation browsers trust to issue TLS certificates after checking that the requester controls the domain. How validation and renewal work.

Know first. Know why. Tell your client before they call.

Paste your client list. Both regions start checking.

Start the 14-day trialWhat Beamfar watches

No card for the trial.