Implement HSTS (HTTP Strict Transport Security)
HSTS forces browsers to always use HTTPS for your site, preventing protocol downgrade attacks and SSL stripping.
- 1
HSTS is an HTTP header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Once a browser sees this header over HTTPS, it will only use HTTPS for your site for max-age seconds, ignoring HTTP. This prevents downgrade attacks and SSL stripping. includeSubDomains applies to all subdomains. preload allows submission to the HSTS preload list (built into browsers).
- 2 Hash Calculator →
HSTS does not use hashing directly, but the preload list submission requires your site to be served over HTTPS with a valid certificate. Verify your certificate chain is complete and your HTTPS configuration is correct before enabling HSTS — once a browser caches HSTS, it will refuse HTTP connections, and a broken HTTPS will make the site inaccessible.
- 3 HMAC Generator →
For API authentication over HTTPS, use HMAC to sign requests. HSTS ensures the connection is HTTPS, and HMAC ensures the request is authentic. Together they provide confidentiality (HTTPS) and integrity (HMAC). This is a common pattern for API security.
Frequently asked questions
- What is the HSTS preload list?
- A list of domains built into browsers that always use HTTPS, even on the first visit (before seeing the HSTS header). Submit your domain at hstspreload.org. Requirements: valid HTTPS, HSTS header with max-age ≥ 1 year, includeSubDomains, and serve the header on the root domain. Once preloaded, removal takes months — do not preload if you might need HTTP.
- Can HSTS lock users out?
- Yes. If your HTTPS certificate expires or is misconfigured, browsers with HSTS cached will refuse to connect (they will not fall back to HTTP). This is why you must monitor certificate expiration and have automated renewal. Start with a short max-age (e.g., 300 seconds) for testing, then increase to 1 year once confident.
Workflows that solve this
Learn more
Want to understand why?