What HSTS does

How it works

Even with a redirect from HTTP to HTTPS, the first request often goes out unencrypted, for example when someone just types example.com. On a public Wi-Fi network an attacker can intercept exactly that request and keep the visitor on an unencrypted copy.

HSTS (HTTP Strict Transport Security) closes that gap. Your site sends the Strict-Transport-Security header over HTTPS. For the time given, the browser remembers to call that name over HTTPS only. It turns http:// into https:// itself, before any request leaves the device. If there is a certificate error, the visitor can no longer click past the warning.

The browser only honours the header over HTTPS and only for the name that sent it. That is why HTTP should redirect to HTTPS on the same host first (see HTTPS).

What matters

• max-age of one year. The duration is in seconds. 31536000 (one year) is recommended; under half a year the protection is too short, because the next visit after it expires is unprotected again.
• includeSubDomains only if every subdomain can do HTTPS. The protection then covers shop.example.com and all the others too. A subdomain without a certificate can no longer be opened in the browser.
• max-age=0 switches HSTS off. Browsers that already knew it forget it. It is only meant for an orderly retreat.
• One header, one value. Without a readable max-age browsers ignore the header. If it is sent twice, the first one counts.
• preload is a separate step. With preload, includeSubDomains and at least one year, the domain can be submitted at hstspreload.org to the list built into browsers. Then even the very first visit is protected. Getting off the list takes months, so think it through first.

How to set it up

The recommended header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

It is set in the web server or the application, by you, your agency or through your hosting provider's control panel.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

With nginx the line goes into the server block for HTTPS. If you are not sure every subdomain can do HTTPS, start without includeSubDomains and with a short duration, check everything, then raise it to one year. Many CDNs and CMS security plugins offer HSTS as a switch.