HSTS (HTTP Strict Transport Security) is a response header that tells browsers to connect to a website only over HTTPS for a set period, and to block visitors from bypassing certificate errors.
HSTS is a security header your website sends that tells browsers to only ever connect to it over HTTPS. Once a browser has seen it, it upgrades every future visit to HTTPS automatically and won't let visitors click past certificate errors. It closes the small gap where someone could be sent to an unencrypted version of your site.
When someone types yourbusiness.com into their browser, the very first request often goes out over plain, unencrypted HTTP before your site redirects them. HSTS tells the browser to skip that step next time and go straight to HTTPS.
How does HSTS work?
Your server adds one line, called a header, to every HTTPS page it sends:
Strict-Transport-Security: max-age=31536000; includeSubDomains
max-age is how long the browser should remember the rule, in seconds. 31536000 is one year. includeSubDomains applies the rule to addresses like shop.yourbusiness.com too.
Once a browser has seen the header, it upgrades every future link to your site to HTTPS on its own. If the certificate is ever invalid, it shows an error with no "continue anyway" button, so a visitor can't be talked past a fake site.
Why does HSTS matter for small businesses?
HSTS mainly protects visitors on networks you don't control, like coffee shop or airport Wi-Fi. On those networks, an attacker can try to intercept the first unencrypted request and keep the visitor on a fake HTTP version of your site. HSTS removes that opening for returning visitors.
For most sites, turning it on is a single setting, and it's one of the six security headers our scan checks.
How do I check or set up HSTS?
Check whether you already send it with our free security headers checker.
Before turning it on, make sure your whole site, and any subdomains, load correctly over HTTPS with a valid SSL certificate. Then add the header where your site is hosted: in Cloudflare, your host's control panel, a WordPress security plugin, or your server config.
The HSTS preload site suggests ramping up max-age in stages: 5 minutes (max-age=300), then 1 week (max-age=604800), then 1 month (max-age=2592000), checking for broken pages at each stage before moving to a longer value.
HSTS vs HSTS preload
Regular HSTS only kicks in after a browser's first visit. Preloading builds your domain into browsers so it's protected from the very first visit. It's also hard to undo, so treat it as an optional extra for later, not a starting point.
A free CyberVigil scan checks HSTS alongside your HTTPS redirect and certificate.
Common questions
Can HSTS break my website?
It can if parts of your site, or subdomains when you use includeSubDomains, don't work over HTTPS yet. Browsers will refuse to load them. Make sure everything works over HTTPS first, then start with a short max-age and increase it.
Should I add my site to the HSTS preload list?
Usually not. The preload list's own maintainers say HSTS is recommended but preloading is not, because removal from the list is slow. Regular HSTS gives most small businesses the benefit without the risk.
Is HSTS the same as an HTTPS redirect?
No. A redirect moves visitors from HTTP to HTTPS after their first request. HSTS makes the browser skip the unencrypted request entirely on future visits. You want both.
Sources
- RFC 6797: HTTP Strict Transport Security (HSTS) (IETF / RFC Editor)
- Strict-Transport-Security header (MDN Web Docs)
- HSTS Preload List Submission (hstspreload.org (Chromium project))
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.