HSTS Header

What is this?

HSTS (HTTP Strict Transport Security) is a response header that tells browsers: "always use HTTPS for this domain - never HTTP, even if someone types http://."

Strict-Transport-Security: max-age=31536000; includeSubDomains

Once a browser receives this header, it'll enforce HTTPS for your domain for max-age seconds (31536000 = 1 year), even if the user or a link tries to use HTTP.

Why it matters

Even with HTTPS and a redirect, there's a window of vulnerability on the very first visit to your site:

1. User types yourdomain.com
2. Browser connects over HTTP first
3. Your server redirects to HTTPS
4. Browser follows redirect

Step 2-3 happens over plain HTTP. On public WiFi, an attacker (man-in-the-middle) can intercept that initial HTTP request, modify it, and keep the user on HTTP the whole time. This is called an SSL stripping attack. HSTS eliminates step 2 entirely - the browser goes straight to HTTPS.

How to fix it

Add this header to all HTTPS responses:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Providers & tools

{
  "headers": [{
    "source": "/(.*)",
    "headers": [{"key": "Strict-Transport-Security",
                 "value": "max-age=31536000; includeSubDomains"}]
  }]
}