Strict-Transport-Security (HSTS)

Tells browsers to use HTTPS for a host and optionally its subdomains.

Use HSTS to prevent browsers from silently falling back to insecure HTTP after a site has been verified to work over HTTPS.

securityheaderhttpstls

Header (http)

Strict-Transport-Security: max-age=31536000; includeSubDomains

HSTS is only honored when delivered over a valid HTTPS connection. The browser remembers the policy and upgrades future HTTP navigations to HTTPS.

Only add includeSubDomains when every subdomain supports HTTPS. The preload directive is a commitment to long-term HTTPS support and should not be added casually.

Common mistakes

Testing HSTS on a domain before all subdomains are HTTPS-ready.
Expecting HSTS to protect the first-ever insecure visit without preload or another trusted link.

IANA registry: http-fields/field-names

Registry reference: RFC 6797: HTTP Strict Transport Security (HSTS)

Content-Security-Policy (CSP)Referrer-Policy Secure Cookie Attribute

Sources

MDN Web Docs: HTTP