HSTS (HTTP Strict Transport Security)
Sitecheck Team
A security policy that forces browsers to only access a site over HTTPS.
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to always use HTTPS for future requests to the domain. Once a browser receives it, it will refuse to connect over insecure HTTP for the specified duration.
Why it matters: HSTS prevents man-in-the-middle attacks that downgrade connections to HTTP and ensures encryption is always used. It also helps avoid accidental mixed‑content errors.
Quick tips:
- Send the header from the first HTTPS response, for example
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. - Consider enabling the HSTS preload list with the appropriate flags.
- Ensure every subdomain is HTTPS before including
includeSubDomains.