Strict-Transport-Security
HSTS: forces HTTPS. Browser upgrades HTTP to HTTPS and remembers for max-age. includeSubDomains, preload optional.
ResponseSyntax
Strict-Transport-Security: max-age=<seconds>[; includeSubDomains][; preload]Example values
| Value | Explanation |
|---|---|
| max-age=31536000 | 1 year |
| max-age=31536000; includeSubDomains; preload | Full HSTS |
cURL usage
curl -I https://example.com # Check HSTS
Common mistakes
Short max-age; enabling before HTTPS works everywhere.