HSTS
HTTP Strict Transport Security (HSTS) is a security header that tells browsers to always connect to a website over HTTPS, never plain HTTP. It prevents downgrade attacks and SSL stripping.
§ 1 Definition
HSTS is an HTTP response header that instructs the browser to automatically upgrade all attempts to access the site over HTTP to HTTPS for a specified period. Once a browser receives an HSTS header for a domain, it will refuse to connect over HTTP even if the user types http:// or clicks an http:// link. This prevents SSL stripping attacks where an attacker intercepts an initial HTTP request and keeps the connection on HTTP. HSTS also eliminates the latency of HTTP-to-HTTPS redirects on subsequent visits. The header includes a max-age directive (how long to enforce), an optional includeSubDomains flag, and an optional preload flag for inclusion in browser preload lists.
§ 2 HSTS Header Directives
max-age: Required. Specifies seconds the policy is in effect. For production, 31536000 (1 year) is standard. includeSubDomains: Optional. Extends the policy to all subdomains. Use with caution if any subdomain cannot support HTTPS. preload: Optional. Signals the site owner intends to submit the domain to browser HSTS preload lists. Once preloaded, the browser enforces HTTPS before any connection attempt.
§ 3 HSTS Preload
Browser vendors maintain HSTS preload lists that ship with the browser. Domains on the list are hardcoded to HTTPS-enforced before the browser ever makes a request. This eliminates the first-visit vulnerability where HSTS has not yet been seen. Submit a domain at hstspreload.org. Requirements: valid HTTPS certificate, HSTS header with max-age >= 31536000, includeSubDomains, and preload directives. Removal from the preload list is difficult and slow, so only preload when you are certain all subdomains support HTTPS permanently.
§ 4 SSL Stripping Attacks
Without HSTS, a user who types example.com or clicks an http:// link sends an initial request over HTTP. An attacker performing a man-in-the-middle attack can intercept this request, keep the connection on HTTP, and present a fake page. The user never sees a redirect to HTTPS. HSTS prevents this by telling the browser to skip HTTP entirely. This is why HSTS is a critical complement to HTTPS.
§ 5 Note
§ 6 Common questions
- Q. What happens if a user visits an HSTS site for the first time?
- A. On the first visit, the user's browser has not yet seen the HSTS header. If they type http://, the request goes over HTTP. The server must redirect to HTTPS and include the HSTS header. On subsequent visits, the browser enforces HTTPS automatically.
- Q. Can I remove my domain from the preload list?
- A. Removing a domain from browser preload lists is difficult and takes months to propagate through browser updates. Only preload when you are certain.
- Q. Does HSTS work on localhost?
- A. Browsers generally do not enforce HSTS on localhost (127.0.0.1 or ::1) to avoid breaking local development.
- HSTS forces HTTPS-only connections, preventing SSL stripping.
- max-age=31536000; includeSubDomains; preload is the recommended configuration.
- HSTS preload hardcodes HTTPS enforcement before the first visit.
- Use preload only when all subdomains permanently support HTTPS.
Atomic Glue configures HSTS headers with appropriate max-age and subdomain policies on all deployments, and assists with preload list submission for clients who need it. Trust & Security.
Get in touchHTTP Strict Transport Security (HSTS) is a security header that tells browsers to always connect to a website over HTTPS, never plain HTTP. It prevents downgrade attacks and SSL stripping.
Category: Security (also: Web Development)
Author: Atomic Glue Security Team
## Definition
HSTS is an HTTP response header that instructs the browser to automatically upgrade all attempts to access the site over HTTP to HTTPS for a specified period. Once a browser receives an HSTS header for a domain, it will refuse to connect over HTTP even if the user types http:// or clicks an http:// link. This prevents SSL stripping attacks where an attacker intercepts an initial HTTP request and keeps the connection on HTTP. HSTS also eliminates the latency of HTTP-to-HTTPS redirects on subsequent visits. The header includes a max-age directive (how long to enforce), an optional includeSubDomains flag, and an optional preload flag for inclusion in browser preload lists.
## HSTS Header Directives
**max-age**: Required. Specifies seconds the policy is in effect. For production, 31536000 (1 year) is standard. **includeSubDomains**: Optional. Extends the policy to all subdomains. Use with caution if any subdomain cannot support HTTPS. **preload**: Optional. Signals the site owner intends to submit the domain to browser HSTS preload lists. Once preloaded, the browser enforces HTTPS before any connection attempt.
## HSTS Preload
Browser vendors maintain HSTS preload lists that ship with the browser. Domains on the list are hardcoded to HTTPS-enforced before the browser ever makes a request. This eliminates the first-visit vulnerability where HSTS has not yet been seen. Submit a domain at hstspreload.org. Requirements: valid HTTPS certificate, HSTS header with max-age >= 31536000, includeSubDomains, and preload directives. Removal from the preload list is difficult and slow, so only preload when you are certain all subdomains support HTTPS permanently.
## SSL Stripping Attacks
Without HSTS, a user who types example.com or clicks an http:// link sends an initial request over HTTP. An attacker performing a man-in-the-middle attack can intercept this request, keep the connection on HTTP, and present a fake page. The user never sees a redirect to HTTPS. HSTS prevents this by telling the browser to skip HTTP entirely. This is why HSTS is a critical complement to HTTPS.
## Note
HSTS is only respected over HTTPS connections. The first HTTP request is still vulnerable until the HSTS header is received. This is why preloading exists. Never set includeSubDomains if any subdomain (like a CNAME to an external provider) cannot serve HTTPS.
## Common questions
Q: What happens if a user visits an HSTS site for the first time?
A: On the first visit, the user's browser has not yet seen the HSTS header. If they type http://, the request goes over HTTP. The server must redirect to HTTPS and include the HSTS header. On subsequent visits, the browser enforces HTTPS automatically.
Q: Can I remove my domain from the preload list?
A: Removing a domain from browser preload lists is difficult and takes months to propagate through browser updates. Only preload when you are certain.
Q: Does HSTS work on localhost?
A: Browsers generally do not enforce HSTS on localhost (127.0.0.1 or ::1) to avoid breaking local development.
## Key takeaways
- HSTS forces HTTPS-only connections, preventing SSL stripping.
- max-age=31536000; includeSubDomains; preload is the recommended configuration.
- HSTS preload hardcodes HTTPS enforcement before the first visit.
- Use preload only when all subdomains permanently support HTTPS.
## Related entries
- [HTTPS / TLS](atomicglue.co/glossary/https-tls)
- [SSL Certificate](atomicglue.co/glossary/ssl-certificate)
- [Security Headers](atomicglue.co/glossary/security-headers)
Last updated December 2024. Permalink: atomicglue.co/glossary/hsts