HSTS Explained: Enforce HTTPS Without Locking Out Your Domain

HSTS instructs a browser that a domain should use HTTPS for a defined period. After receiving the header over a valid HTTPS connection, the browser upgrades later HTTP requests before sending them.

Deploy in stages

1. Fix HTTPS and redirect HTTP.
2. Start with a short max-age.
3. Monitor every required host.
4. Increase duration gradually.
5. Add includeSubDomains only when all subdomains support HTTPS.

Preload is a commitment

Browser preload lists can enforce HTTPS before the first visit. Removal takes time, so do not preload a domain with forgotten or externally managed subdomains.

What HSTS does not do

It does not fix expired certificates or application vulnerabilities. A certificate warning remains a stop condition.

HSTS begins after a trusted visit

Unless the domain is preloaded, the browser must first receive the header over valid HTTPS. Keep the HTTP-to-HTTPS redirect because new clients and non-browser tools may not have stored policy.

Recovery planning

Automate certificate renewal and alert well before expiry. With a long max-age, a certificate outage cannot be worked around by temporarily serving HTTP—which is precisely the protection and the operational responsibility.

Choose max-age through staged confidence

Begin with a short policy after HTTPS works across the site, then increase it while monitoring certificate renewal and subdomains. Add includeSubDomains only when every current and future subdomain can support HTTPS. Preload is a separate, difficult-to-reverse commitment and should not be treated as a badge.

Operational readiness is part of the security control

Automate renewal, monitor from outside the hosting provider and keep account ownership current. Test the certificate served by the CDN or load balancer, not merely the file installed on the origin. Maintain redirects for new clients and tools that have not stored HSTS state.

HSTS prevents a browser from accepting an HTTP downgrade; it does not fix mixed content, vulnerable application code or an invalid certificate. Treat those as separate deployment checks.