HSTS (Strict-Transport-Security)

What are HSTS?

HSTS (HTTP Strict Transport Security) is a security policy a site sends with the Strict-Transport-Security response header. It tells browsers to connect only over HTTPS for a set period: if a visitor types http:// or follows an old HTTP link, the browser switches to HTTPS itself before sending any request.

The header has three parts. max-age is how long, in seconds, the browser should remember the rule. includeSubDomains applies it to every subdomain. preload signals that you want the domain on the HSTS preload list built into Chrome, Firefox, Safari and Edge, which protects even a visitor’s very first visit. Browsers only honour the header when it arrives over HTTPS.

Why HSTS matter for SEO

A 301 from HTTP to HTTPS still leaves the first request unencrypted, which an attacker on the same network can intercept. HSTS closes that gap, and it also removes the redirect hop for returning visitors, so pages start loading slightly sooner.

HSTS is not a Google ranking factor. It is a security best practice that completes a move to HTTPS, and it is one of the security headers audits check for.

It is also hard to undo. Browsers remember it for the full max-age, and removal from the preload list can take months to reach users. If any subdomain still needs HTTP, includeSubDomains will break it.

How to enable HSTS

1. Make sure every page and every subdomain you plan to cover works over HTTPS, and that HTTP redirects to HTTPS.
2. Start with a short max-age, such as max-age=300 (five minutes), and check nothing breaks.
3. Raise it in steps to a week, a month, then a year (max-age=31536000).
4. Add includeSubDomains once you are sure no subdomain needs HTTP.
5. Only then consider preloading at hstspreload.org. It requires a max-age of at least one year, includeSubDomains and preload, served on the bare domain over HTTPS.

HSTS example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload