Strict-Transport-Security (HSTS)

The HSTS header ensures that web browsers will always connect over HTTPS. Let's look at an example of HSTS:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Here’s a breakdown of the example HSTS header by directive:

  • max-age

    • This is the expiry time in seconds for this setting

  • includeSubDomains

    • An optional setting that instructs the browser to also apply this setting to all subdomains.

  • preload

    • This optional setting allows the website to be included in preload lists. Browsers can use preload lists to enforce HSTS before even having their first visit to a website.