Strict-Transport-Security
Tells browsers to use https for this domain and refuse to fall back, even if the user types http or follows a plain link.
Recommended value
Strict-Transport-Security: max-age=31536000; includeSubDomains
What it does
Redirecting http to https is not enough. The first request still leaves the browser in plaintext, and anyone on the network path can answer it before your redirect ever arrives. HSTS closes that window by making the browser refuse plaintext for the domain entirely.
max-age is in seconds. A year (31536000) is the usual value and the minimum for preload eligibility. Short values are common during rollout and often never raised.
includeSubDomains matters more than it looks. Without it a subdomain can be served over http, and because cookies are shared up the domain tree, an attacker who controls any subdomain over plaintext can set cookies your main site will read.
preload ships your domain in the browser's built-in list, so even the very first visit is protected. Getting removed from that list is slow, so only add it once every subdomain genuinely serves https.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: