HSTS Explained: max-age, preload, and What Breaks

What the header actually does

Strict-Transport-Security tells the browser that this host must only ever be contacted over HTTPS for the next N seconds. Once received, the browser rewrites internal http:// links, blocks certificate-error bypass clicks, and refuses plain HTTP entirely — before any request leaves the machine.

That is why it defends against downgrade attacks that a redirect cannot: a redirect still sends the first request in plaintext, which is exactly the request an attacker on the network wants to intercept.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age is a countdown you cannot cancel

The max-age is stored on the client. If you serve a year and then remove the header, every browser that already saw it keeps enforcing HTTPS for up to a year. There is no server-side switch to turn it off.

CertH treats 180 days (15552000 seconds) as the threshold for A+. One year is the usual production value. Anything below 180 days still counts as HSTS enabled for the summary, but it will not unlock A+.

includeSubDomains and preload are separate decisions

includeSubDomains extends the rule to every subdomain. If any subdomain only speaks HTTP — an internal tool, a legacy admin panel, a staging host — it becomes unreachable for anyone who visited the parent domain. Audit DNS first.

Preload goes further: the domain is baked into a list shipped with browsers, so the rule applies even on a first visit, before any header is seen. Removal takes months and requires a submission to the removal list. Do not add preload until the header has been stable for at least a few months.

• •Serve the header on every HTTPS response, including error pages — a 404 without it teaches the browser nothing.
• •Never send HSTS over plain HTTP; browsers ignore it by spec, so a misconfigured redirect loop cannot be fixed this way.
• •Check subdomains for HTTP-only services before adding includeSubDomains.
• •Add preload last, and only after the max-age has been at one year for a while.

A rollout that does not break anything

Start with a short max-age so a mistake expires quickly: max-age=300. Keep it for a week and watch for broken subdomains and mixed-content reports. Then move to a day, then a month, then a year. Each step is reversible within the previous window, which is the whole point of starting short.

If something does break, the fix is to serve HTTPS correctly on the broken host — not to remove the header, which no longer helps anyone who already received it.

FAQ