HSTS Header Generator

HSTS (HTTP Strict Transport Security) is an HTTP response header that instructs browsers to only connect to a website over HTTPS, never HTTP, for a specified duration. Once a browser receives the HSTS header, it automatically converts any HTTP requests for that domain to HTTPS before sending them — even if the user types http:// or clicks an HTTP link. This prevents SSL stripping attacks and ensures all connections are encrypted.

For maximum security, use max-age=31536000 (one year). This is also the minimum required for HSTS preloading. Start with a shorter value like 300 or 3600 to test, then increase to 31536000 once you are confident your site works correctly over HTTPS. Remember that once a browser has cached the HSTS policy, it will refuse HTTP connections for the duration of the max-age — setting a very long value means recovery from a misconfigured HTTPS setup is difficult.

includeSubDomains extends the HSTS policy to all subdomains. This is recommended if all your subdomains (mail.example.com, shop.example.com, etc.) are served over HTTPS. Do not include it if any subdomain is HTTP-only — those subdomains will become unreachable via HTTP for the duration of the max-age. If you plan to apply for HSTS preloading, includeSubDomains is required.

HSTS preloading means your domain is hardcoded into browsers' built-in HSTS lists — shipping with Chrome, Firefox, Safari, and Edge. Preloaded domains always use HTTPS even on the very first visit, before any HSTS header has been received. To qualify for preloading, your HSTS header must include max-age of at least 31536000, includeSubDomains, and the preload directive. Submit your domain at hstspreload.org — note that removal is slow and difficult, so only preload once you are committed to permanent HTTPS.