HSTS configuration: The Complete 2026 Guide

The Strict-Transport-Security header has three directives. The max-age directive sets the duration in seconds that the browser should enforce HTTPS. The includeSubDomains directive applies the policy to all subdomains. The preload directive allows inclusion in browser preload lists MDN Strict-Transport-Security. A standard configuration for production sites uses max-age=31536000 (one year), includeSubDomains, and preload. Start with a short max-age of 300 seconds (five minutes) during initial deployment. Increase to the full year after confirming no HTTPS issues exist.

HSTS does not directly improve rankings. It indirectly supports SEO by ensuring search engine crawlers always access the HTTPS version. Crawlers never see an HTTP version with HSTS enforcement in place. This reduces the chance of indexing errors and duplicate content issues. HSTS also improves core web vitals by removing the redirect hop from HTTP to HTTPS. Every eliminated redirect reduces page load time. Google's PageSpeed Insights and Lighthouse measure redirect chains Google Lighthouse Redirects. HSTS eliminates the HTTP-to-HTTPS redirect for returning visitors.

The HSTS preload list is a hardcoded list of domains that browsers ship with. Domains on the preload list automatically enforce HTTPS from the very first connection HSTS Preload Submission. This eliminates the first-request vulnerability where a user's initial HTTP request could be intercepted. Submit your domain to hstspreload.org after you confirm full HTTPS coverage. The submission process requires a valid HSTS header with max-age of at least one year, includeSubDomains directive, and the preload directive. The preload list updates ship with browser releases. Inclusion takes several months.

Once a domain is on the preload list, removal is difficult. The HSTS policy is enforced for the max-age duration even after you remove the header. For preloaded domains, removal requires a full browser update cycle. Test thoroughly before submitting to the preload list. Verify that every subdomain supports HTTPS. Any subdomain without HTTPS breaks for users. The browser enforces HTTPS and the subdomain does not serve it. Use the HSTS preload submission checker to validate readiness HSTS Preload Removal.

Missing includeSubDomains is a frequent error. Without it, subdomains remain vulnerable to downgrade attacks. An attacker can bypass HSTS by redirecting to a subdomain not covered by the policy. A short max-age undermines the security benefit. Values under 30 days (2592000 seconds) provide weak protection. Setting max-age too low also fails the preload requirements. The most dangerous misconfiguration is enabling HSTS before HTTPS is fully deployed. Visitors cannot access the HTTP version after the header is cached. This can lock users out of the site if HTTPS breaks.

Use SSL Labs Server Test to verify the HSTS header configuration SSL Labs Server Test. The test checks max-age, includeSubDomains, and preload status. Use curl to inspect the header directly. Run curl -s -D- https://example.com | grep Strict-Transport-Security to confirm the header is present. Monitor HSTS violations through the browser's console in development. On production, monitor error rates and user reports after enabling HSTS. Use a phased rollout: start with a short max-age for one week, then increase to the full year.

The HSTS configuration audit checks the header value on every response, verifies subdomain coverage, and confirms preload eligibility. Note the gap between your current max-age and the recommended one-year duration. Audit quarterly.