HSTS (HTTP Strict Transport Security) is a security mechanism that tells browsers to access a host only over HTTPS for a set period. The server sends it in the Strict-Transport-Security response header. After that, the browser rewrites every http:// request for the host to https:// itself, without asking the server first, and it does not let users click through certificate errors.
How does HSTS work?
The header carries up to three directives:
max-age=<seconds>sets how long the browser remembers the rule. Each HTTPS response renews the timer.includeSubDomainsextends the rule to all subdomains.preloadsignals that the owner agrees to inclusion in browser preload lists.
Browsers ignore the header when it arrives over plain HTTP, which stops attackers from planting a policy on an insecure connection (RFC 6797). Setting max-age=0 removes the rule.
The preload list
A plain HSTS rule does not protect the very first request of a new visitor, since the browser has not yet seen the header. Preload lists ship with the browser and close this gap. For the list behind hstspreload.org, a domain needs a valid certificate, a redirect from HTTP to HTTPS, HTTPS on all subdomains, and a header on the base domain with max-age of at least 31536000 (one year), includeSubDomains and preload. Removal is possible, but the site says it takes months to reach users.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Common mistakes
- Setting
includeSubDomainswhile a subdomain, such as an internal tool, has no valid HTTPS. Browsers then refuse to load it. - Submitting to the preload list before every subdomain works over HTTPS.
- Sending the header only on HTTP responses, where it is ignored.
Sources
- RFC 6797: HTTP Strict Transport Security (HSTS)rfc-editor.org
- Strict-Transport-Security – MDN Web Docsdeveloper.mozilla.org
- HSTS Preload List Submissionhstspreload.org
Last updated: