Strict-Transport-Security explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

Strict-Transport-Security: HSTS tells the browser to always connect over HTTPS for a set time, even if someone types http:// or clicks an old link. Recommended value: max-age=63072000; includeSubDomains; preload.

What risk does it prevent?

Without it, the first request can be downgraded to plain HTTP, letting attackers on public Wi‑Fi intercept or rewrite traffic (SSL stripping).

What is the safe recommended value?

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

What are the gotchas?

The preload directive is hard to undo: removal from browser preload lists takes months.
includeSubDomains breaks any subdomain that still serves plain HTTP. Audit subdomains first.
Start with a short max-age (e.g. 300) and ramp up to 1–2 years once verified.
Browsers ignore HSTS sent over plain HTTP; it must be sent on the HTTPS response.

Which compliance controls reference it?

PCI DSS 4.0 4.2.1
NIST 800-171 3.13.8
CMMC SC.L2-3.13.8
OWASP ASVS V14.4.5
SOC 2 CC6.7

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).