HTTPS protects a connection once it is made. HSTS tells the browser to always use HTTPS for your site, so an attacker on the same network cannot strip it down to plain HTTP on the first request.
The header
Strict-Transport-Security: max-age=31536000; includeSubDomains
Start with a short max-age (for example 300) while you confirm everything on the domain works over
HTTPS, then raise it to a year. Add preload only when you are sure: a preloaded domain is hard to
take back.
Where to set it
| Host | How |
|---|---|
| Nginx | add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; |
| Apache | Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" |
| Vercel | vercel.json, under headers, source /(.*) |
| Netlify | a _headers file, or [[headers]] in netlify.toml |
| Cloudflare | SSL/TLS, Edge Certificates, HTTP Strict Transport Security |
| Next.js | headers() in next.config |
The header is ignored over plain HTTP, so it only counts on your HTTPS responses.
← Firebase security rules left open (Firestore, Realtime Database, Storage) IDOR and broken access control: how to test it →
Last reviewed 2026-09-26