HTTP Strict Transport Security (HSTS) Header Generator

HSTS HEADER CONFIGURATION

Max-Age Duration

Include Subdomains (includeSubDomains) HSTS Preload List Tag (preload)

GENERATED HSTS HEADER DIRECTIVE

HTTP Header Output

Nginx Config Directive

HSTS Header Best Practices & Preload Guide

HSTS eliminates man-in-the-middle SSL stripping attacks by enforcing client-side HTTPS caching directly in user browsers.

HSTS Preload List Submission Criteria

Serve a valid SSL/TLS certificate on the root domain.
Redirect HTTP traffic to HTTPS on port 443.
Serve the HSTS header on the root domain with max-age of at least 31536000 seconds.
Include the includeSubDomains directive.
Include the preload directive.

Related Security Tools

Generate CSP headers with the CSP Header Generator, prevent clickjacking with the X-Frame-Options Generator, or test CORS policy with the CORS Header Generator.

Frequently Asked Questions

Common questions about this tool.

What is an HSTS header? ▼

HTTP Strict Transport Security (`Strict-Transport-Security`) is a web security header that forces browsers to interact with your site exclusively over encrypted HTTPS connections, preventing SSL stripping attacks.

What is the recommended max-age for HSTS preload eligibility? ▼

To qualify for the Chrome/Firefox HSTS Preload List, the `max-age` directive must be set to at least 31536000 seconds (1 year) and include both `includeSubDomains` and `preload`.

Why should I test with a short max-age first? ▼

Setting a long `max-age` (e.g. 1 year) before ensuring all subdomains have valid SSL certificates can lock users out of subdomains that do not support HTTPS.

What does `includeSubDomains` do? ▼

`includeSubDomains` applies the HSTS policy to all current and future subdomains (e.g. `api.example.com`, `blog.example.com`).

How do I submit my site to the official HSTS Preload List? ▼

Once your site serves the header with `max-age=31536000; includeSubDomains; preload`, submit your root domain to hstspreload.org.