Security headers

How to fix: HSTS (Strict-Transport-Security) header

The Strict-Transport-Security (HSTS) header tells browsers to only ever connect to your site over HTTPS for a set period, even if someone types http:// or follows an old link.

Not sure whether your site has this problem? Check it in seconds.

Security Headers checker Run a free audit

Why it matters

Without it, the very first request to your site can go over plain HTTP, where a network attacker can intercept or redirect it (a downgrade attack). HSTS closes that gap for returning visitors.

How to check

Look for Strict-Transport-Security in the response headers of your HTTPS site, or run our Security Headers checker. Note: browsers ignore the header on plain HTTP responses.

How to fix it

Header value

Strict-Transport-Security: max-age=31536000; includeSubDomains

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Next.js (next.config.ts)

const nextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" }],
      },
    ];
  },
};
export default nextConfig;

Common mistakes

Starting with a one-year max-age before you're sure every subdomain supports HTTPS. Test with a short value (for example max-age=300), then raise it.
Adding includeSubDomains when some subdomain (an old admin panel, a mail host) is HTTP-only: browsers will refuse to load it.
Submitting to the HSTS preload list casually. Preload requires max-age of at least one year, includeSubDomains and the preload directive, and removal from browsers' lists takes a long time. Only do it when you're certain.
Many hosts (Vercel, Cloudflare, Netlify) can add HSTS for you; check before adding a second, conflicting header.

Frequently asked questions

Does HSTS replace an HTTP→HTTPS redirect?

No. Keep the redirect: HSTS only takes effect after a browser has seen the header once over HTTPS.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.