< Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

TL;DR: Strict-Transport-Security: max-age=31536000; includeSubDomains makes browsers use HTTPS only for your site for a year. Roll it out with a short max-age first, because a mistake locks out anyone whose HTTPS breaks, and preloading is very hard to reverse.

What it does

The first visit to http://example.com is vulnerable: an attacker on the network can intercept it and keep the victim on HTTP (SSL stripping). A redirect to HTTPS does not help if the redirect itself is stripped. HSTS closes that gap for later visits:

HTTP/2 200
Strict-Transport-Security: max-age=31536000; includeSubDomains

For the next year the browser converts http://example.com/... into https://example.com/... locally, with no network request, and turns certificate warnings into hard errors with no “proceed” button. In Chrome that is the “Your connection is not private” page with NET::ERR_CERT_AUTHORITY_INVALID and no Advanced link; Chrome DevTools shows the local rewrite as 307 Internal Redirect with Non-Authoritative-Reason: HSTS.

Defined in RFC 6797. The header is ignored over plain HTTP, over HTTPS with an invalid certificate, and on IP-address hosts.

Directives

Directive	Meaning
max-age=<seconds>	How long the policy lasts, refreshed on every response with the header. 0 clears it
includeSubDomains	Applies to every subdomain, including internal ones such as intranet.example.com
preload	Signals consent to be on the browser-shipped preload list. The header does not add you; submission does

Safe rollout

1. Make sure every URL you serve works on HTTPS, including subdomains if you use includeSubDomains, and that HTTP redirects with 301 or 308 to HTTPS.
2. Send max-age=300 and watch for problems.
3. Step up: 86400, 604800, then 31536000.
4. Add includeSubDomains only after every subdomain, including old staging and mail hosts, is on valid HTTPS.
5. Consider preload last.

Preload requirements

From hstspreload.org:

• A valid certificate and redirect from HTTP to HTTPS on the same host.
• All subdomains served over HTTPS.
• The header on the apex domain’s HTTPS response with max-age of at least 31536000 (one year), includeSubDomains, and preload.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Submit at hstspreload.org. Removal is possible but it ships with browser releases, so users may be locked to HTTPS for months. Do not preload if any subdomain cannot be HTTPS.

Configuration

nginx. Use always so error responses carry it too. add_header in a location discards inherited add_header lines, so put it at server level or repeat it.

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Express (helmet). Helmet’s default is max-age=31536000; includeSubDomains:

const helmet = require('helmet')
app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true, preload: false }))

Django:

SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = False
SECURE_SSL_REDIRECT = True

Behind a TLS-terminating proxy or Cloudflare. Set it on the layer that speaks HTTPS to clients. Cloudflare has an HSTS toggle under SSL/TLS, Edge Certificates. Do not also set it at the origin with different values.

Verify

curl -sI https://example.com | grep -i strict-transport-security

strict-transport-security: max-age=31536000; includeSubDomains

In Chrome, chrome://net-internals/#hsts lets you query a domain and delete its policy, which is the fast way to recover your own browser after a bad rollout. Firefox users clear it with “Forget about this site”.

Gotchas

• The first visit is still unprotected unless the domain is preloaded; HSTS is “trust on first use”.
• localhost and raw IPs are not affected, but a custom dev domain with HSTS and includeSubDomains can break local http://dev.example.com setups.
• A max-age of 0 over HTTPS is the only way to cancel; letting the cert expire locks users out instead.
• Cookies are not made secure by HSTS; still set the Secure flag.

Related

• HTTPS and TLS guide, Set-Cookie, Content-Security-Policy (upgrade-insecure-requests)
• Site verifier tool

See also the comparison HTTP vs HTTPS: what TLS adds, what it still leaves visible, and HSTS.