The Strict-Transport-Security header, commonly called the HSTS header, tells supporting browsers to use HTTPS for your host for a set period after they receive it. Once a browser has seen the header, it upgrades later requests to that host itself rather than trying plain HTTP first.
It is a straightforward header with one important precondition: HTTPS has to already work properly across your site before you send it.
Without HSTS, a visitor who types your domain without https:// makes an initial plain HTTP request that is then redirected. That first unencrypted request is the window an attacker on the same network can interfere with.
HSTS closes that window for browsers that have already received the header, because they go straight to HTTPS. It does nothing for the very first visit from a browser that has never seen your header before, which is the gap the preload list is meant to address.
The header carries a small number of directives. At a high level:
HSTS removes the browser's willingness to fall back to HTTP. If a certificate expires, a subdomain is not covered, or an old system still serves plain HTTP, visitors may see hard errors with no easy way past them.
Before enabling it, confirm valid certificates on every hostname you serve, working HTTP-to-HTTPS redirects, and a certificate renewal process someone is actually responsible for. Then start with a short max-age and extend it.
In Chrome, press F12, open the Network tab, reload the page over HTTPS and inspect the document request's Response Headers for Strict-Transport-Security. If the header is absent, browsers have no standing instruction to force HTTPS for your host.
The free website security check on this site also reports whether the header is returned, along with the rest of your externally visible HTTPS configuration.
ScoutLab's free website security check looks at whether these headers are present and how they are configured on your public site, alongside HTTPS, DNS and email protection signals. It reports what it observes so you can discuss the results with whoever maintains your website.
Run the free website security checkIt is an HTTP response header that tells supporting browsers to use HTTPS for your host for the period given by its max-age directive. After receiving it, the browser upgrades requests to that host itself instead of attempting plain HTTP first.
Load your site over HTTPS, press F12, open the Network tab, reload, then click the document request and read the Response Headers. Look for a Strict-Transport-Security entry and note its max-age value and whether includeSubDomains or preload are present.
Only after deliberate validation. includeSubDomains applies the HTTPS requirement to every subdomain, including ones you may have forgotten about, and preload is difficult to reverse quickly. Confirm that every hostname serves valid HTTPS before committing to either.
Not by itself. A browser has to receive the header once before it can act on it, so the first request from a brand new browser is not covered. Preload lists exist to close that gap, at the cost of a commitment that is slow to undo.
Security headers are browser-facing HTTP response controls and one layer of defence. They work alongside patching, access control, backups and monitoring rather than replacing them.
