HSTS (the Strict-Transport-Security header) tells browsers to connect to your domain only over HTTPS, even if a user types http:// or clicks an http link. This prevents downgrade and SSL-stripping attacks that exploit that first insecure request.

What is a good HSTS max-age?

Two years (63072000 seconds) is the common target for a mature setup. Start much lower while testing — a day or a week — then raise it. A max-age under about six months provides little real protection.

Should I join the HSTS preload list?

Only if your domain and all its subdomains will be HTTPS-only indefinitely. Preloading makes browsers enforce HTTPS from the very first visit, but it is slow and difficult to undo, so it's a commitment, not a quick win.

What Is HSTS (and Should You Join the Preload List)?

Updated August 2026 · about a 6-minute read

HSTS — HTTP Strict Transport Security — is a single response header that tells browsers "only ever talk to this domain over HTTPS." It closes a real gap: without it, the very first request a browser makes can go over plain HTTP, where an attacker on the network can hijack or downgrade it (an "SSL-stripping" attack). Yet HSTS is missing on roughly 45% of sites.

The header

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

max-age — how long (in seconds) the browser remembers to force HTTPS. 63072000 is two years. Under ~6 months is barely useful.
includeSubDomains — applies the rule to every subdomain too. Only add it once you're sure all subdomains serve HTTPS.
preload — see below.

Roll it out safely

HSTS is sticky by design — once a browser has seen it, it enforces it for the whole max-age even if you change your mind. So ramp up:

Serve everything over HTTPS first (redirect HTTP → HTTPS).
Start with a short max-age, e.g. max-age=86400 (one day).
Confirm nothing breaks, then raise to six months, then two years.
Add includeSubDomains only after verifying every subdomain is HTTPS.

The HSTS preload list

Browsers ship with a built-in list of domains that are HTTPS-only from the very first visit — no initial HTTP request at all. To join, your header must include preload, use includeSubDomains, and a max-age of at least one year; then you submit the domain at hstspreload.org. Powerful, but hard to reverse — removal takes months to propagate through browser releases. Only preload a domain you are certain will be HTTPS-only indefinitely.

Verify it's actually set

Because HSTS lives in a response header, a proxy change or a deploy can silently drop it. HSTS is one of the security headers our free checker grades — including flagging a max-age that's too short to matter. Check yours below.

Check your site now — free, no signup

See your TLS certificate, security headers and DNS graded in seconds. Then let Perimeter watch it and email you the moment something breaks.

Open the full checker →