Build HSTS

Build a Strict-Transport-Security header with max-age, subdomains, and preload options.

freeworks offlinenothing uploaded
ToolHSTS Builder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

max-age, includeSubDomains, and preload become a Strict-Transport-Security response header, with max-age measured in seconds. Browsers honor the header only when received over a secure connection.

  • Long max-age provides durable transport protection.
  • Preload has requirements beyond emitting the header.

Worked example

One-year HSTS with preload eligibility
Build an HSTS header with 1-year max-age, subdomains, and preload. Eligible for the browser preload list
Input
											Max age: 31536000
Include sub domains: true
Preload: true
Output
												# HTTP Strict Transport Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

# Duration: 1 year(s)
# Preload: Eligible for browser HSTS preload list

# Apache (.htaccess)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Express.js
app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
  next();
});

# To submit to the HSTS preload list:
# https://hstspreload.org/
# Requirements: max-age >= 31536000, includeSubDomains, preload

When to use this

Web servers, security audits, and platform TLS configuration build HSTS.

Edge cases

  • HSTS sent over HTTP is ignored.
  • includeSubDomains can break an HTTP-only child host.
  • Preload removal is slow because browser lists update separately.

References