HSTS HTTP Strict Transport Security: How to Enable Safely

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that tells a browser to only connect to a website over HTTPS, automatically converting any HTTP request to HTTPS before it is sent. When you enable HSTS on your server, you instruct the browser to remember this rule for a specified period, preventing protocol downgrade attacks and cookie hijacking. This article explains how HSTS works, how to enable it safely, and how to avoid common pitfalls that can lock users out of your site.

What HSTS Does and Why It Exists

HSTS is defined in RFC 6797 and is a standard, not an informal term. The problem it solves is that a user might type example.com into their browser, and the browser will first attempt an HTTP connection (port 80) before being redirected to HTTPS (port 443). During that initial HTTP request, an attacker on the same network (e.g., public Wi-Fi) can intercept the traffic, inject malicious content, or steal session cookies. HSTS eliminates this window by telling the browser to never make an HTTP request to that domain at all. Once a browser has received the HSTS policy, it will internally rewrite http://example.com to https://example.com before any packet leaves the device.

How HSTS Works: The Strict-Transport-Security Header

HSTS is implemented via a response header sent by the server on an HTTPS response. The header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Each directive has a specific meaning:

• max-age (required): The time in seconds that the browser should remember to use HTTPS only. A value of 31536000 equals one year.
• includeSubDomains (optional): Applies the policy to all subdomains. For example, blog.example.com would also be forced to HTTPS.
• preload (optional): Allows the domain to be submitted to the HSTS preload list maintained by browser vendors, so the browser enforces HTTPS even before the first visit.

The header is only honored when sent over a secure HTTPS connection. If a browser receives it over plain HTTP, it is ignored, which prevents an attacker from injecting a fake HSTS header to cause a denial of service.

How to Enable HSTS Safely: Step-by-Step

Enabling HSTS is straightforward, but doing it incorrectly can make your site unreachable for a long time. Follow these steps in order:

1. Ensure all content is served over HTTPS. Every resource—images, scripts, stylesheets, API calls—must be available via HTTPS. If any subresource is loaded over HTTP, the browser will block it once HSTS is active, breaking the page.
2. Set a short max-age first. Start with max-age=300 (5 minutes) and monitor your site for a few days. This limits the damage if you discover a problem.
3. Gradually increase max-age. Once you are confident, increase to max-age=86400 (1 day), then to max-age=2592000 (30 days), and finally to max-age=31536000 (1 year).
4. Add includeSubDomains only after verifying all subdomains support HTTPS. If any subdomain (like old.example.com) does not have a valid certificate, users will be unable to access it.
5. Consider the preload list last. The preload list is a hardcoded list in browsers; once your domain is on it, it is very difficult to remove. Only submit after you have run max-age=31536000; includeSubDomains; preload for at least a week and confirmed everything works.

For Apache, add the header to your virtual host configuration or .htaccess:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

For Nginx, add it to your server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

For Cloudflare or other CDNs, you can enable HSTS from the dashboard, but the same gradual approach applies.

Common Problems and How to Avoid Them

The most common issue is enabling HSTS before your site is fully HTTPS-ready. This can result in mixed content warnings or complete page failures. Another frequent mistake is using includeSubDomains when you have a subdomain that is not secure, such as a development server or an old webmail interface. That subdomain will become inaccessible for the duration of max-age.

Another problem is the HSTS header not being sent on all responses. Some servers only send it on the main page, but browsers expect it on every HTTPS response to refresh the policy. Ensure your configuration applies the header globally.

Finally, if you ever need to disable HSTS, you cannot simply remove the header—the browser will keep the policy until max-age expires. You can send max-age=0 to clear it, but this only works if the browser receives that response over HTTPS. If your certificate has expired, users are stuck.

HSTS Preload List: What It Is and How to Submit

The HSTS preload list is a curated list of domains that browsers hardcode as HTTPS-only. When a domain is on the list, the browser will never make an HTTP request to it, even on the first visit. This eliminates the first-request vulnerability entirely. To submit a domain, you must serve the header with max-age=31536000, includeSubDomains, and preload for a continuous period (typically at least a week). Then you submit the domain at hstspreload.org. The site checks your headers and, if valid, adds you to the list. Removal is possible but takes months and requires a request to the maintainers. Only use preload if you are absolutely certain your site and all subdomains will support HTTPS forever.

HSTS vs. Other Security Headers

HSTS is often confused with other security headers, but they serve different purposes:

• Content-Security-Policy (CSP): Controls which resources the browser is allowed to load, preventing XSS and data injection.
• X-Frame-Options: Prevents your site from being embedded in an iframe, mitigating clickjacking.
• X-Content-Type-Options: Stops the browser from MIME-sniffing, reducing the risk of malicious file uploads.

HSTS is unique because it operates at the transport layer, not the content layer. It does not validate certificates; it simply enforces HTTPS. You should use HSTS in conjunction with other headers, not as a replacement.

Frequently Asked Questions

What happens if I enable HSTS and my SSL certificate expires?

If your certificate expires while HSTS is active, browsers will refuse to connect to your site entirely. They will not fall back to HTTP because HSTS forbids it. The only fix is to renew the certificate and ensure the HTTPS connection works again. This is why it is critical to monitor certificate expiry and set up automatic renewal.

Can HSTS break my site if I use a CDN?

It can, if the CDN does not support HTTPS on all edge nodes or if you have a subdomain that bypasses the CDN. Most major CDNs support HSTS, but you must configure it at the CDN level and ensure all origins also support HTTPS. Test with a short max-age first.

Does HSTS protect against all man-in-the-middle attacks?

No. HSTS only prevents protocol downgrade attacks. It does not protect against DNS spoofing if the attacker can also spoof the certificate. However, when combined with certificate transparency and public key pinning (now deprecated), it raises the bar significantly. For most sites, HSTS is a necessary baseline.

How do I check if HSTS is working on my site?

You can use the browser’s developer tools. In Chrome or Firefox, open DevTools, go to the Network tab, reload the page, and click on the main document request. Look for the strict-transport-security header in the Response Headers. You can also use online tools like hstspreload.org to check your current header and preload status.

What is the difference between HSTS and HTTPS redirect?

An HTTPS redirect (301 or 302) tells the browser to go to the HTTPS version after the HTTP request is made. HSTS tells the browser to never make the HTTP request in the first place. The redirect still leaves a small window for attack; HSTS closes it. You should use both: a redirect for users who have never visited your site, and HSTS for returning users.

Can I use HSTS on a site with no subdomains?

Yes. You can omit includeSubDomains if you only have a single domain. However, if you later add subdomains, you will need to update the header. It is often easier to include it from the start if you plan to have subdomains.

Related

• HN Search API Pagination: Why 1000 Results Max?
• Locked NVIDIA User Account: How to Unlock It
• AI Script Breakdown: From Draft Changes to Trusted Schedules