HSTS: what it is and why it is needed

What is HSTS

HSTS (HTTP Strict Transport Security) is an HTTP security header that instructs a browser to always use HTTPS for a given domain for a specified period, even if the user explicitly enters http:// in the address bar.

After receiving an HSTS header, the browser saves a record: "this site is HTTPS-only." If someone tries to open the HTTP version, the browser automatically switches to HTTPS before sending a request to the server. This prevents an SSL stripping attack, in which an attacker intercepts an unprotected HTTP request before the redirect.

Why HSTS is needed

Protection against SSL stripping: without HSTS, the first HTTP request is vulnerable—an attacker on the network can intercept it before the server issues a 301 redirect to HTTPS.

Protection against man-in-the-middle (MITM) attacks: HSTS makes it impossible to intercept traffic through a malicious HTTP proxy.

Faster loading: the browser does not make an HTTP request or wait for a redirect—it connects over HTTPS immediately.

Subdomain protection: the includeSubDomains directive extends protection to all subdomains.

Google Chrome Security: sites with HSTS receive a green status in Chrome's Security assessment.

How to configure HSTS

HSTS header

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Parameters:

• max-age=31536000 — cache duration in seconds (1 year = 31536000)
• includeSubDomains — apply to all subdomains
• preload — inclusion in browsers' HSTS Preload List

Nginx

server {
    listen 443 ssl;

    # Только в production, не в dev-окружении!
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Next.js

// next.config.js
async headers() {
  return [{
    source: '/(.*)',
    headers: [{
      key: 'Strict-Transport-Security',
      value: 'max-age=31536000; includeSubDomains; preload'
    }]
  }]
}

HSTS Preload List

Browsers (Chrome, Firefox, Safari, Edge) contain a built-in list of HSTS domains called the HSTS Preload List. For sites on this list, HTTPS is enforced even before the first visit.

Submit a request for inclusion: hstspreload.org

Preload requirements:

• A valid SSL certificate
• HTTP → HTTPS redirect
• An HSTS header with max-age >= 31536000
• Required: includeSubDomains and preload
• All subdomains must work over HTTPS

Note: removal from the Preload List takes months. Make sure all subdomains support HTTPS before submitting a request.

Check HSTS on reChecker

Use Security Headers to check HSTS and other security headers. The tool will show:

• Whether the HSTS header is present and its value
• The max-age value (whether it is long enough)
• Whether the includeSubDomains and preload directives are present
• An overall security rating for the headers

FAQ

Can HSTS be added to an HTTP site? No. HSTS is only useful for HTTPS sites. Browsers ignore an HSTS header received over HTTP. First move the site to HTTPS, then add HSTS.

What should I do if I need to switch back to HTTP? If you have already added HSTS with a long max-age, switching back to HTTP is difficult—browsers will force the use of HTTPS. To disable it gradually, reduce max-age to 0 and wait for the cache to expire for all users.

Should I add HSTS in a development environment? No. HSTS on localhost or a development domain will block HTTP access during development. Use an environment variable: if (NODE_ENV === 'production') to apply HSTS only in production.