Reference
What is HSTS?
HSTS is a response header telling browsers to use HTTPS for a domain for a stated period, refusing to connect over HTTP even if a user types it. It closes the window where a first insecure request can be intercepted.
Also called: Strict-Transport-Security
What it prevents
A redirect from HTTP to HTTPS still involves one insecure request, which can be intercepted on a hostile network. With HSTS remembered, the browser never makes that request in the first place.
Deploying it safely
- Confirm HTTPS works everywhere, including every subdomain you intend to include
- Start with a short max-age to verify nothing breaks
- Increase to a year once confident
- Consider includeSubDomains only when every subdomain genuinely supports HTTPS
The commitment worth understanding
HSTS is remembered by the browser for the duration you set. If HTTPS breaks during that period, affected visitors cannot reach the site at all — which is why the max-age is raised gradually rather than set to a year on day one.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.