HSTS (HTTP Strict Transport Security) Reference
Reference 为 HSTS 头: forcing HTTPS, max-age, preload, 和 includeSubDomains.
Header Directives
HSTS instructs browsers to always use HTTPS for a domain, preventing SSL stripping attacks. The max-age directive specifies how long (seconds) to enforce HTTPS. includeSubDomains extends the policy to all subdomains. preload allows inclusion in the browser's built-in HSTS list. Once set, the browser refuses HTTP connections to the domain for max-age seconds. The first visit before HSTS is set remains vulnerable (hence preload).
- max-age
- Enforcement duration
- includeSubDomains
- All subdomains
- preload
- Built-in list
secondsextends policyfirst-visit safeDeployment
Set HSTS only over HTTPS; HTTP headers are ignored. Start with a short max-age (e.g., 300) to test, then increase to 31536000 (1 year) or more. includeSubDomains should only be set if all subdomains support HTTPS. Preload requires meeting strict criteria and submitting to hstspreload.org. HSTS cannot be easily undone (max-age=0 only works if browser sees it over HTTPS). Combine with redirects from HTTP to HTTPS for defense in depth.
- short first
- Test with 300s
- preload
- hstspreload.org
- undo
- max-age=0
then increasestrict criteriaonly over HTTPS