What max-age should I use?

One year (31536000 seconds) is common and is what the HSTS preload list asks for. EngineeringScore reports a max-age below 15,552,000 seconds (about six months), or one it cannot read, as a weak HSTS header with its own guide.

Should I add includeSubDomains?

Only when every subdomain already serves HTTPS. Browsers remember the policy for the whole max-age, so test with a short max-age first if you are unsure.

Does HSTS work over plain HTTP?

No. Browsers ignore the header on http:// responses. Redirect HTTP to HTTPS first, then send the header on the HTTPS responses.

Security Small

HSTS: enable Strict-Transport-Security

Enable HSTS

HSTS (HTTP Strict Transport Security) closes the gap that plain HTTPS leaves open: the very first request a browser makes to a domain, before it has ever seen the redirect to HTTPS, can still be intercepted and downgraded on an untrusted network. The header tells the browser to skip HTTP entirely for future visits, removing that window.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

Without HSTS, a user's first visit or any link they click can be silently downgraded to plain HTTP by an attacker on the network, exposing them to session hijacking even though HTTPS is available.

How to fix

1 Add Strict-Transport-Security: max-age=31536000; includeSubDomains to all responses.
2 Verify HTTPS is enforced everywhere before enabling includeSubDomains.
3 Consider HSTS preload submission once the policy is stable.

Fix it in your stack

Nginx

The HTTPS server block.

# server block, HTTPS site
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache

The HTTPS virtual host.

# .htaccess or virtual host, mod_headers enabled
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Next.js

next.config.js, for every path.

// next.config.js
module.exports = {
  async headers() {
    return [{ source: '/:path*', headers: [{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }] }];
  },
};

Node.js (Express)

With the helmet package; maxAge is in seconds.

app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));

Cloudflare

SSL/TLS, then Edge Certificates: enable HTTP Strict Transport Security (HSTS).

Common mistakes

Setting a very short max-age (or leaving it at the default) so the protection expires between visits and offers little real benefit.
Adding includeSubDomains before every subdomain is confirmed to support HTTPS, which can break subdomains that are still HTTP-only.
Assuming HSTS replaces the HTTP-to-HTTPS redirect: it only protects repeat visitors who have already loaded the header once.

How to verify

1 Inspect the response headers for Strict-Transport-Security and confirm max-age is at least a year (31536000 seconds).
2 Use a header-checking tool to confirm the value is present on every page, not just the homepage.
3 If subdomains are included, load each one directly over HTTPS to confirm none of them break.

Questions

What max-age should I use?: One year (31536000 seconds) is common and is what the HSTS preload list asks for. EngineeringScore reports a max-age below 15,552,000 seconds (about six months), or one it cannot read, as a weak HSTS header with its own guide.
Should I add includeSubDomains?: Only when every subdomain already serves HTTPS. Browsers remember the policy for the whole max-age, so test with a short max-age first if you are unsure.
Does HSTS work over plain HTTP?: No. Browsers ignore the header on http:// responses. Redirect HTTP to HTTPS first, then send the header on the HTTPS responses.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site