Your site has HTTPS and the padlock shows. Solved? Not quite. There is one gap left: the first request. When someone types yourdomain.com into a browser, that first request often goes out as plain http://, and only then gets redirected to HTTPS.

Why that first request matters

On a hostile network, an attacker sitting between the visitor and your site can catch that unencrypted first request and never let the redirect happen. The visitor keeps browsing over plain HTTP through the attacker's proxy, and every password and card number is readable. The technique is called SSL stripping and it has been around since 2009. It still works on sites without HSTS.

What HSTS does

Strict-Transport-Security tells the browser: for the next N seconds, never talk to this domain over anything but HTTPS. After the first visit, the browser upgrades every request itself, before it leaves the machine. There is no insecure first request left to intercept.

Strict-Transport-Security: max-age=31536000; includeSubDomains
  • max-age is how long the browser remembers, in seconds. A year is the standard value.
  • includeSubDomains extends the rule to every subdomain. Only add it once you are sure all subdomains actually serve HTTPS.
  • preload asks browsers to bake your domain into their shipped list, protecting even the very first visit. It is effectively permanent, so treat it as a one-way door and read the requirements at hstspreload.org first.

The caution

HSTS is sticky by design. If you enable it with a year-long max-age and then break your certificate, visitors cannot click through the warning: the browser refuses. So make sure your HTTPS setup is stable first, start with a shorter max-age if you are unsure, and only then raise it.

Check your site

curl -sI https://yourdomain.com | grep -i strict shows whether the header is present. A free AuditMerlin scan checks it along with 14 other findings and maps each one to the Mozilla or OWASP guideline it comes from. Behind Cloudflare, HSTS is a toggle in the SSL/TLS settings rather than a code change.