HSTS: How to Force Browsers to Always Use HTTPS

You have an SSL certificate and your site runs on HTTPS — but is it really secure? If someone types your address without https://, the first request still goes over unencrypted HTTP, and only then does a redirect move it to the secure connection. That brief moment is an opening for attack. HSTS closes exactly that gap.

What HSTS is

HSTS (HTTP Strict Transport Security) is an HTTP header with which the server tells the browser: from now on, for the next X seconds, open this domain over HTTPS only, no exceptions. The browser remembers this and sends all future requests as HTTPS automatically, even if the user types a plain HTTP link. This prevents the so-called SSL stripping attack, where an attacker tries to keep the victim on an unencrypted connection.

What it looks like and what the parameters mean

The header looks like this: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Three parts:

• max-age — how long (in seconds) the browser remembers the rule. 31536000 is one year, the recommended production value.
• includeSubDomains — the rule applies to every subdomain too. Enable it only once you are sure every single subdomain runs on HTTPS.
• preload — a signal that you want to join the browsers built-in list, where HTTPS is enforced from the very first visit.

How to enable it without risk

The key rule: before you set a long max-age, make sure the whole site and all subdomains work flawlessly over HTTPS. If you later want to disable HTTPS while browsers still remember HSTS, the site will be unreachable for those visitors until max-age expires. So start carefully — set a short max-age (say 300 seconds), verify everything works, then raise it to a year and consider the preload list.

If you would rather not wrestle with server configuration, our SEO hosting plans include free SSL, and HSTS and redirects are set up in a few clicks. Compare the plans and pricing and start with secure HTTPS right away.

Frequently asked questions

Does HSTS slow down the site? No — on the contrary, it saves one redirect because the browser goes straight to HTTPS with no intermediate step.

What if I lose the certificate? While HSTS is active, the browser refuses to open the site without a valid certificate, so renewing the certificate on time is mandatory.

Before enabling HSTS, confirm you have a valid SSL certificate and HTTPS, fix any mixed content, and set proper 301 redirects from HTTP to HTTPS.