# HSTS

Category: [Technical SEO](https://seo-geo-glossary.com/en/glossary/category/technical-seo/) › [Servers, HTTP & caching](https://seo-geo-glossary.com/en/glossary/category/technical-seo/servers-http-caching/) · Also known as: HTTP Strict Transport Security

**HSTS** (HTTP Strict Transport Security) is a security mechanism that tells browsers to access a host only over HTTPS for a set period. The server sends it in the `Strict-Transport-Security` response header. After that, the browser rewrites every `http://` request for the host to `https://` itself, without asking the server first, and it does not let users click through certificate errors.

## How does HSTS work?

The header carries up to three directives:

- `max-age=<seconds>` sets how long the browser remembers the rule. Each HTTPS response renews the timer.
- `includeSubDomains` extends the rule to all subdomains.
- `preload` signals that the owner agrees to inclusion in browser preload lists.

Browsers ignore the header when it arrives over plain HTTP, which stops attackers from planting a policy on an insecure connection (RFC 6797). Setting `max-age=0` removes the rule.

## The preload list

A plain HSTS rule does not protect the very first request of a new visitor, since the browser has not yet seen the header. Preload lists ship with the browser and close this gap. For the list behind hstspreload.org, a domain needs a valid certificate, a redirect from HTTP to HTTPS, HTTPS on all subdomains, and a header on the base domain with `max-age` of at least 31536000 (one year), `includeSubDomains` and `preload`. Removal is possible, but the site says it takes months to reach users.

## Example

```
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

## Common mistakes

- Setting `includeSubDomains` while a subdomain, such as an internal tool, has no valid HTTPS. Browsers then refuse to load it.
- Submitting to the preload list before every subdomain works over HTTPS.
- Sending the header only on HTTP responses, where it is ignored.

## Related terms

- [HTTPS](https://seo-geo-glossary.com/en/glossary/https/index.md)
- [SSL/TLS certificate](https://seo-geo-glossary.com/en/glossary/ssl-tls-certificate/index.md)
- [HTTP header](https://seo-geo-glossary.com/en/glossary/http-header/index.md)
- [301 redirect](https://seo-geo-glossary.com/en/glossary/301-redirect/index.md)

## Sources

- [RFC 6797: HTTP Strict Transport Security (HSTS)](https://www.rfc-editor.org/rfc/rfc6797)
- [Strict-Transport-Security – MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security)
- [HSTS Preload List Submission](https://hstspreload.org/)

---

Last updated: October 7, 2026
URL: https://seo-geo-glossary.com/en/glossary/hsts/