What HSTS means
HSTS closes the gap where a visitor might first reach an insecure version of your site, which attackers can exploit. Once set, browsers refuse plain HTTP connections. It should be enabled only after HTTPS works everywhere on the domain.
Why it matters for your website
Even with HTTPS, a visitor's first request might go over plain HTTP, giving attackers a brief opening. HSTS tells browsers to always use the secure version, closing that gap. It strengthens trust in your site for logins, forms and payments.
Example
An online pharmacy adds an HSTS header, so returning visitors' browsers connect over HTTPS automatically even if someone types the address without https.
Tips
- Confirm every page and subdomain works on HTTPS before turning on HSTS.
- Start with a short max-age, then lengthen it once you are confident.
- Only add includeSubDomains when every subdomain supports HTTPS.
Common mistakes
- Turning on HSTS while some subdomains still need plain HTTP.
- Submitting to the browser preload list without understanding it is hard to undo.
Questions about HSTS
What is HSTS?
HTTP Strict Transport Security: a header telling browsers to only ever connect to your site over HTTPS.
What is the HSTS preload list?
It is a list built into major browsers of sites that should only load over HTTPS, even on the very first visit. Getting removed takes a long time, so add your site with care.
Does HSTS help SEO?
Not directly. It strengthens HTTPS security, and HTTPS itself is something Google considers part of page experience.
