×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Set Up HSTS
Forcing HTTPS connections to protect your users.
HTTP Strict Transport Security (HSTS) is a simple but powerful security header that tells browsers to only connect to your site over HTTPS. This completely prevents SSL stripping attacks, where an attacker forces a user's connection from HTTPS to HTTP and intercepts their data. This guide covers HSTS implementation, including the preload list and best practices.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
HSTS Max-Age Too Low medium
Missing IncludeSubDomains low
What is HSTS and Why Do You Need It?
HSTS (HTTP Strict Transport Security) is a security header that tells browsers to only connect to your website via HTTPS. Once a user visits your site and receives the HSTS header, their browser will automatically use HTTPS for all future visits, even if they type "http://" or click an HTTP link. This prevents SSL stripping attacks, where an attacker intercepts the initial HTTP request and downgrades the connection to plaintext.
How to Implement HSTS on Common Servers
The most important HSTS directive is `max-age`, which tells the browser how long to remember the policy (in seconds). A value of at least 31536000 (one year) is recommended. Here are the configurations:
- Apache: `Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"`
- Nginx: `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;`
- Node.js (Express): `res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");`
- PHP: `header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");`
- Cloudflare: Enable "Always Use HTTPS" and "HSTS" in the SSL/TLS settings.
- Netlify: Add to `_headers` file: `/* Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
- Vercel: Add to `vercel.json`: `{"headers": [{"source": "/(.*)", "headers": [{"key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains; preload"}]}]}`
HSTS Preload List – What It Is and How to Join
The HSTS preload list is a hardcoded list of sites that browsers will only connect to via HTTPS. Once your site is on the list, it's permanent for years. To qualify: 1) Serve a valid SSL certificate. 2) Redirect all HTTP traffic to HTTPS. 3) Serve the HSTS header with `max-age=31536000` and `includeSubDomains`. 4) Include the `preload` directive. Then submit at hstspreload.org. This is the ultimate protection against SSL stripping.
Common HSTS Mistakes to Avoid
The biggest mistake is setting a low `max-age` – this weakens protection. Never use a `max-age` below 31536000 unless you're testing. Another mistake is forgetting to include `includeSubDomains`, leaving subdomains unprotected. Also, ensure you have a valid SSL certificate and force HTTPS redirection before enabling HSTS – once it's active, visitors can't access your site if HTTPS is broken.
The Problem
Without HSTS, your site is vulnerable to SSL stripping
- Attackers can intercept and downgrade HTTP connections
- Users may accidentally visit the HTTP version of your site
- Session cookies can be stolen in transit
- Password and data exposure on insecure connections
OffURL Solution
OffURL checks your HSTS configuration and provides fix steps
- Detect if HSTS header is present
- Check `max-age` value against best practices
- Verify `includeSubDomains` directive
- Check for `preload` directive
- Provide server‑specific implementation examples
Key Features
HSTS detection
We check if the HSTS header is present and correctly configured.
Max-age validation
We verify that your `max-age` is at least 31536000 seconds.
Configuration examples
Get ready‑to‑use configs for Apache, Nginx, Express, and more.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
How do I check if HSTS is properly set up on my site?
Run an OffURL audit. Our scanner will check for the HSTS header, verify the `max-age` value, and check for `includeSubDomains` and `preload` directives. You'll get a clear pass/fail status with specific recommendations for your server. If HSTS is missing or misconfigured, we'll provide the exact code to fix it.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.