HSTS Header Generator
Generate a Strict-Transport-Security (HSTS) header with max-age, includeSubDomains, and preload options.
63072000 = 2 years, a commonly recommended value
Header:
How to Use the HSTS Header Generator
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only ever connect to your site over HTTPS, never plain HTTP, for the duration you specify — even if a user types "http://" or clicks an old HTTP link. Set a max-age in seconds (two years, 63072000, is a commonly recommended value), decide whether it should also apply to all subdomains, and optionally flag the header for preload submission. Copy the assembled header and set it as the value of the Strict-Transport-Security response header from your web server or CDN.
Example
A max-age of 63072000 with includeSubDomains and preload both enabled produces:Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Common Use Cases
- Preventing man-in-the-middle downgrade attacks that try to force a visitor onto plain HTTP.
- Ensuring every subdomain of a site is also forced onto HTTPS automatically.
- Preparing the exact header value needed before applying to the Chromium HSTS preload list.
FAQs
- What does HSTS actually protect against? It stops browsers from ever making a plain HTTP request to your domain once the header has been seen, closing the window an attacker could otherwise use to intercept an initial unencrypted request and redirect or downgrade it.
- Is submitting to the preload list reversible? Not easily — the list ships baked into browser binaries, so removing a domain can take months to reach users, and it should only be done once your entire site (including every subdomain, if includeSubDomains is set) is fully and permanently HTTPS-ready.
- What max-age should I start with? Many sites start with a shorter value (like a few minutes or hours) to confirm HTTPS is working correctly everywhere, then increase it to a long duration such as one or two years once confident.