HTTPS enforcement with Strict-Transport-Security

The Strict-Transport-Security response header (HSTS) tells browsers that a host should only be accessed over HTTPS: future attempts to use HTTP are automatically upgraded, and the browser will not let the user bypass secure connection errors such as an invalid certificate. The max-age directive sets, in seconds, how long the browser remembers the policy, and each response that carries the header refreshes that expiration; includeSubDomains extends the policy to all subdomains. To qualify for preloading, max-age must be at least 31536000 (one year) and includeSubDomains must be present. A host is identified by domain name only — an IP address cannot be an HSTS host — and the policy applies to all ports: the browser rewrites port 80 to 443 while leaving other explicit ports unchanged. The header must be sent over HTTPS; browsers ignore it over HTTP so a manipulator in the middle cannot plant or prematurely expire a policy. Scope: Web security. Reviewed October 4, 2026.