Web & certificates

What is HSTS? HTTP Strict Transport Security explained

HSTS is an HTTP header with which a website tells the browser: only call me via HTTPS for a certain time. This prevents attacks via unencrypted first requests.

How HSTS works

On HTTPS responses the server sends the Strict-Transport-Security header with max-age in seconds. The browser remembers it and turns every http:// request to this domain into https:// itself – even when someone clicks an old link.

includeSubDomains extends the rule to all subdomains. With the preload directive and an entry in the browsers' HSTS preload list, the protection applies even on the very first visit; this requires a max-age of at least one year and includeSubDomains.

Browsers ignore HSTS headers sent over HTTP. The header therefore belongs in the HTTPS responses.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains

31536000 seconds are one year.

Common mistakes

includeSubDomains is set although some subdomains have no HTTPS yet – browsers can then no longer reach them.
A very short max-age (e.g. 300 seconds) – the protection expires right away.
Applying for preload without knowing the consequences – the entry can only be undone slowly.

How the Domain Trust Check rates HSTS

Criterion “HTTPS main domain” (weight 5 of 5): Reachable via HTTPS, trusted and matching certificate, remaining validity, TLS 1.2/1.3 instead of TLS 1.0/1.1, permanent HTTP→HTTPS redirect and HSTS.

Criterion “HTTPS www” (weight 5 of 5): The same checks for the www subdomain. If there is no www subdomain, the criterion is not applicable.

Standard: RFC 6797