HSTS: HTTP Strict Transport Security pour le SEO

TL;DR — HSTS is a petit instruction votre serveur sends navigateurs que dit “always use HTTPS for my site — never plain HTTP.” It plugs a tiny security hole que a normal HTTP→HTTPS redirection leaves ouvrir, and it doesn’t hurt SEO. But it’s strict on objectif: une fois it’s on, a broken certificate breaks votre site with aucun façon pour visitors to click past the warning. Turn it on seulement quand votre HTTPS setup is genuinely solid.

Ce que HSTS is

Vous déjà know vous devez be on HTTPS — the encrypted, padlock version of votre site. The normal façon to force it is a redirection: quand someone types http://yoursite.com, votre serveur sends les a 301 redirection to https://yoursite.com. Que fonctionne, but there’s a sliver of a gap. Que very premier requête — the un avant the redirection fires — encore goes out over insecure HTTP. An attacker sitting on the même Wi-Fi peut pounce in que window.

HSTS — HTTP Strict Transport Security — closes que gap. It’s a short instruction (a “header”) votre serveur adds to its réponses — but seulement the ones served over a genuinely secure connection; the même header sent over plain HTTP is ignored, since an attacker pourrait sinon inject or strip it — que indique que un navigateur: pour the suivant however-many months, jamais même essayer HTTP pour ce site — go straight to HTTPS. It’s a policy chaque navigateur learns and stores pour itself, pas something que changements votre serveur. Une fois a navigateur has seen it, it upgrades http:// liens to https:// tout on its propre, avant anything leaves the device. Evidence for this claim After receiving HSTS, a browser upgrades future HTTP attempts to HTTPS before sending the request. Scope: MDN documents user-agent enforcement after the header has been learned; first-visit protection requires preload or a prior secure visit. Confidence: high · Verified: 2026-07-14 MDN: Strict-Transport-Security header

Fait HSTS aider or hurt SEO?

Neither, directement. HSTS is a security and trust fonctionnalité, pas a ranking lever. It won’t déplacer vous up le résultats — but fait correct it won’t hurt vous soit. The un chose to comprendre is que HSTS n’est pas a substitute pour votre redirections. Vous encore besoin votre réel server-side 301 redirections from HTTP to HTTPS, parce que that’s ce que Google and Bing en réalité voir and utiliser. HSTS fonctionne à l’intérieur le navigateur pour réel human visitors; robots d’exploration don’t rely on it. Garder les deux.

The un big warning

HSTS is deliberately unforgiving. Une fois a navigateur has “learned” votre site is HTTPS-only, it va refuse to charger le site at tout si votre certificate ever expires or misconfigures — with aucun “proceed anyway” button. That’s the whole point (it arrête attackers from tricking personnes onto a fake HTTP version), but it signifie a lapsed certificate goes from “annoying warning” to “site is bas pour anyone who’s visited avant.”

There’s aussi a supercharged version appelé preload que bakes votre domain into le navigateur itself. It’s great, but getting off the preload liste plus tard is slow and painful — think months. So preload is a one-way door: seulement walk via it quand you’re certain. Evidence for this claim HSTS preload requires at least a one-year max-age, includeSubDomains, and preload; removal can take months to reach users. Scope: The Chromium preload service documents submission and removal behavior; requirements can change and should be rechecked before submission. Confidence: high · Verified: 2026-07-17 Chromium: HSTS Preload List Submission

Vouloir the header syntax, le navigateur-only internal redirection robots d’exploration jamais voir, the preload requirements, and the réel lockout scenarios? Switch to the Avancé tab.

TL;DR — HSTS is the Strict-Transport-Security réponse header, honored seulement quand a navigateur receives it over a secure connection, and stored per-client as future policy pour que host. It closes the “first request problem” a 301 alone leaves ouvrir: the initial HTTP requête from a nouveau visitor is insecure jusqu’à the redirection fires, and that’s the window an SSL-stripping attacker veut. Three directives: max-age (requis, seconds), includeSubDomains, preload. Quand a navigateur enforces HSTS it rewrites the URI to HTTPS internally, avant quelconque requête reaches a server — RFC 6797 doesn’t mandate a spécifique code d’état pour que rewrite, though outils souvent surface it as a 307 — so votre server-side 301s are encore mandatory pour moteur de recherches and popularité des liens; HSTS is on top of les, pas à la place. Preload bakes votre domain into le navigateur via hstspreload.org (exige max-age ≥ 31536000, includeSubDomains, and preload) and is fermer to irreversible — removal is a separate submission que takes months to reach utilisateurs. And HSTS is designed to hard-fail on quelconque cert error, so enable it seulement quand HTTPS is robust à travers every subdomain.

The HTTPS hub introduces HSTS as a browser-layer protection que sits on top of votre 301s. Ce page is the deep dive: the exact header syntax, the internal redirection que trips SEOs up, the preload list’s near-irreversibility, and the real-world façons HSTS locks personnes out.

The problem HSTS en réalité solves: the premier requête

Picture a correctement migrated site. Every http:// URL 301-redirections to its https:// twin, the certificate is valid, canonicals point to HTTPS. Semble airtight. It isn’t, quite.

Quand a brand-new visitor types yoursite.com (aucun scheme) or clicks an old http://yoursite.com lien, le navigateur’s premier requête goes out over plain HTTP. Votre serveur réponses with the 301, and every requête après que is secure. But que un initial round-trip happened in the clair — and that’s exactly the window an SSL-stripping attacker on the même network veut. Ils intercept the HTTP requête, garder the victim on HTTP pendant que ils proxy HTTPS to votre serveur, and lire or rewrite everything.

HSTS eliminates que window pour anyone who has visited avant. web.dev is direct à propos de the mechanism: “utiliser Strict Transport Security to tell clients ils devrait toujours connecter to votre server en utilisant HTTPS, même quand suivant an http:// référence. Ce defeats attacks comme SSL Stripping, and avoids the round-trip cost of the 301 redirection.” (web.dev). Que dernier clause matters pour performances aussi: a returning navigateur skips the HTTP→HTTPS round-trip entirely. Evidence for this claim After receiving HSTS, a browser upgrades future HTTP attempts to HTTPS before sending the request. Scope: MDN documents user-agent enforcement after the header has been learned; first-visit protection requires preload or a prior secure visit. Confidence: high · Verified: 2026-07-14 MDN: Strict-Transport-Security header

Two boundary conditions worth being precise à propos de. Premier, HSTS is stored, per-client policy — it lives in que un browser’s propre state pour que host, learned from a header delivered over a secure connection; the même header sent on an HTTP réponse is ignored outright (an attacker who peut inject or strip headers on plain HTTP pourrait sinon neutralize it), and a client que has jamais reçu it — a fresh install, a différent navigateur, a robot d’exploration — has aucun policy to enforce. Second, the rewrite is scheme-and-port aware: an implicit port 80 requête becomes an implicit port 443 requête, but si the original URI named an explicit non-default port, le navigateur garde que même port number and simply contacts it over HTTPS à la place.

The header syntax

HSTS is un réponse header with up to three directives. Per MDN, the formulaires are:

Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000; includeSubDomains
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

• max-age=<seconds> — requis. “The temps, in seconds, que le navigateur devrait remember que a host is seulement to be accessed en utilisant HTTPS” (MDN). 31536000 is un année; 63072000 is two. The clock resets on every réponse que carries the header, so an active site continually renews its policy. Ce is relative, per-client state: simply removing the header doesn’t immédiatement clair it — a navigateur que déjà learned the policy garde enforcing it jusqu’à its stored max-age runs out. To turn HSTS off pour clients que déjà learned it, vous have to actively serve max-age=0 over a secure réponse; le navigateur alors forgets the policy on its suivant secure visit. (max-age=0 clears a learned policy seulement — it ne fait pas supprimer a domain from the separate preload liste.)
• includeSubDomains — optional. “Si ce directive is specified, the HSTS policy s’applique to tout subdomains of the host’s domain as bien” (MDN). Powerful and dangerous in equal mesurer — voir the lockout scenarios ci-dessous.
• preload — optional. A flag que signals votre intent to be on le navigateur preload liste. It ne fait pashing on its propre; it’s a prerequisite pour submitting to hstspreload.org. Evidence for this claim HSTS preload requires at least a one-year max-age, includeSubDomains, and preload; removal can take months to reach users. Scope: The Chromium preload service documents submission and removal behavior; requirements can change and should be rechecked before submission. Confidence: high · Verified: 2026-07-17 Chromium: HSTS Preload List Submission

The behavior, à nouveau from MDN: “Avant chargement an http URL, le navigateur checks the domain nom contre its HSTS hosts liste. Si the domain nom is a cas insensitive match pour an HSTS host or is a subdomain of un que specified includeSubDomains, alors le navigateur replaces the URL scheme with https.”

The internal upgrade robots d’exploration jamais voir (ce is the SEO crux)

Here’s the unique la plupart misunderstood chose à propos de HSTS, and the raison it can’t replace votre redirections.

Quand a navigateur upgrades an http:// requête sous HSTS, it rewrites the URI to HTTPS internally, avant quelconque network requête is made — RFC 6797 exige the scheme substitution itself but ne fait pas mandate a particulier code d’état pour it (RFC 6797 §8,3), so a donné navigateur or exploration outil may represent que internal step cependant it likes — nombreux afficher it as an internal 307, but that’s client/tool-specific, pas a protocol guarantee. Ce que matters pour le SEO is simpler and holds regardless of the étiquette: aucun server is contacted pour the HTTP version, so aucun robot d’exploration ever sees it. Googlebot and Bingbot don’t carry a learned HSTS policy autour the façon a returning human’s Chrome fait — ils hit votre serveur fresh, and ce que ils besoin to voir là is a réel, server-side 301. Evidence for this claim RFC 6797 requires the user agent to rewrite a known-HSTS-host HTTP URI to HTTPS internally, but does not mandate any specific redirect status code for that internal rewrite; how a given browser or crawling tool represents that step (e.g., as an internal 307) is a client/tool implementation detail, not a protocol requirement. Scope: RFC 6797 Section 8.3 ("URI Loading and Port Mapping") specifies the UA MUST replace the URI scheme with https; it does not prescribe an HTTP status code for that internal substitution, since no HTTP exchange occurs for it. Section 7.2's suggestion of status code 301 addresses ordinary server-side redirect behavior, not this internal client-side rewrite. Confidence: high · Verified: 2026-07-17 RFC 6797 §8.3 — URI Loading and Port Mapping

So the rule is blunt: HSTS ne fait pas replace votre serveur-side 301s. The 301 is ce que moteur de recherches utiliser to comprendre the protocol déplacer and to consolidate signals (301 and autre redirection permanentes don’t causer a loss in PageRank, per Google). Le navigateur-only internal upgrade is a user-experience and security couche on top. Vous besoin les deux, doing différent jobs:

• 301 (server-side): pour robots d’exploration, indexation, and popularité des liens.
• Internal 307-style upgrade (browser-side, from HSTS): pour returning humans and SSL-stripping protection — the exact status representation varies by client/outil.

Quelconque guide que indique vous HSTS “handles the redirect so you can drop your 301” is incorrect in a façon que va quietly cost vous.

HSTS preload: the near-permanent version

max-age protects returning visitors, but it has a bootstrap problem: a first-time visitor who has jamais reçu votre header is encore exposed on que initial requête. Preload solves it by hardcoding votre domain into le navigateur’s source itself, so le navigateur knows you’re HTTPS-only avant it has ever connected.

Vous opt in at hstspreload.org. The requirements are exact:

1. “Serve a valid certificate.”
2. “Redirect from HTTP to HTTPS on the same host, if you are listening on port 80.”
3. “Serve all subdomains over HTTPS” — notamment in particulier the www subdomain si a DNS record exists.
4. On the base domain’s HTTPS réponse, an HSTS header où “the max-age doit be au moins 31536000 seconds (1 année),” “the includeSubDomains directive doit be specified,” and “the preload directive doit be specified.” (hstspreload.org)

That’s pourquoi the two-year exemple ci-dessus (max-age=63072000; includeSubDomains; preload) is the shape personnes submit — remarque ces are the exact submission requirements as publié by hstspreload.org; treat les as the current bar, pas a permanent constant, and re-check the live page avant vous submit.

It helps to garder four distinct states straight, since personnes conflate les constantly:

Removal runs the même four states in reverse, and simplement as slowly: removing the preload directive from votre header rend vous eligible pour the removal formulaire, alors submission is pending, and the domain stays enforced pour quelconque utilisateur on a navigateur construire que encore ships it — jusqu’à que construire cycles out.

Now the partie que turns preload into a one-way door. From the submission site itself: “Be aware que inclusion in the preload liste ne peut pas easily be undone. Domains peut be supprimé, but it takes months pour a modifier to reach utilisateurs with a Chrome mettre à jour and we ne peut pas faire guarantees à propos de autre navigateurs.” (hstspreload.org). And its propre advice: “Don’t requête inclusion unless you’re certain que vous pouvez prise en charge HTTPS pour votre entier site and tout its subdomains in the long term.”

Practical translation: preload is a genuinely great security posture, but si vous ever besoin to serve anything — a legacy subdomain, an acquired brand, an internal outil — over plain HTTP à nouveau, you’re stuck waiting on navigateur release cycles to reach every utilisateur. Kinsta’s guide puts the operational reality plainly: it peut be a difficult and time-consuming traiter to obtenir votre domain supprimé. Treat preload as permanent.

Pourquoi HSTS is designed to hurt quand choses break

HSTS’s strictness n’est pas a bug — it’s the entier security guarantee. web.dev spells out the tradeoff: “Clients que have listed votre site as a connu HSTS Host are probable to hard-fail si votre site ever has an error in its TLS configuration, (tel as an expired certificate). HSTS is explicitly designed ce façon to garantir que network attackers can’t trick clients into accessing le site sans HTTPS.” (web.dev).

The conclusion Google draws is the sentence I’d tattoo on anyone à propos de to flip ce on: “Don’t enable HSTS jusqu’à you’re certain votre site operation is robust suffisant to éviter ever deploying HTTPS with certificate validation errors.” (web.dev).

“Hard-fail” signifie exactly que: aucun “proceed anyway” lien, aucun click-through. On a normal HTTPS page, an expired cert throws a scary interstitial que a determined utilisateur peut bypass. On an HSTS host, le navigateur refuses outright. So the échec mode of a missed certificate renewal changements category — from “trafic dips parce que personnes are scared off” to “le site is unreachable pour every returning visitor.”

Real-world lockout scenarios

The façons HSTS bites En pratique almost toujours trace back to includeSubDomains or preload getting ahead of votre réel HTTPS coverage:

• The forgotten subdomain. Vous définir includeSubDomains on example.com, but legacy.example.com (an old app, a status page, a vendor outil) seulement speaks HTTP or has a cert que doesn’t cover it. Every navigateur que saw the header now refuses to charger que subdomain. Nothing modifié on que server — the policy reached bas and broke it.
• The wildcard-cert gap. A *.example.com wildcard covers foo.example.com but pas foo.bar.example.com (a wildcard is un DNS étiquette deep). Si a deeper subdomain relies on HTTP or a mismatched cert, includeSubDomains locks it out.
• The expired cert on an HSTS host. Renewal automation fails, the cert lapses, and au lieu de a bypassable warning vous obtenir a site that’s bas pour everyone whose navigateur remembers votre policy — jusqu’à vous obtenir a valid cert back and ils reconnect and recevoir a fresh secure réponse. Là is aucun faster override.
• Preload regret. Vous preloaded, alors a business besoin forces an HTTP-only service sous the domain. Rolling que back is two separate, non-instant jobs, pas un: serving max-age=0 over HTTPS seulement clears the learned policy pour clients que reconnect avant leur old max-age would’ve expired anyway, pendant que getting the domain out of the preload liste is a distinct submission que encore takes navigateur release cycles — months — to reach utilisateurs, independent of anything vous modifier on votre serveur.
• Local dev / staging collisions. Preloading example.com with includeSubDomains peut faire dev.example.com or a localhost-style internal host sous the même apex refuse HTTP, breaking local workflows in surprising façons.

None of ces are raisons to éviter HSTS. They’re raisons to stage it: short max-age premier, ajouter includeSubDomains seulement après auditing every subdomain, and reserve preload pour quand you’re certain.

HSTS n’est pas a ranking play (and doesn’t touch canonicalization)

To be clair on the SEO framing: HSTS n’est pas a ranking signal. HTTPS itself is a deliberately tiny un — Google appelé it a “very lightweight signal” affecting fewer que 1% of requêtes — and HSTS is a couche on top of HTTPS, pas a separate ranking input. It aussi doesn’t directement contrôler canonicalization or indexation. Google’s propre documentation is plus spécifique que a flat “doesn’t matter,” though: Google prefers HTTPS as canonical over an equivalent HTTP page except quand there’s an invalid certificate, insecure page dependencies, an HTTPS page que redirections to HTTP, or an HTTP rel="canonical" tag (Google: consolidating duplicate URLs). HSTS ne peut pas fix or override quelconque of que. It’s a browser-side policy with aucun influence on Google’s canonicalization logic — a bad certificate or a broken redirection chain peut encore push Google toward an HTTP canonical regardless of ce que votre HSTS header dit. Canonicalization is driven by votre 301s, votre certificate, votre rel="canonical", and votre lien internes — HSTS earns its placer pour security, utilisateur trust, and closing the SSL-stripping gap — do it pour ceux raisons, garder votre 301s and certificate genuinely solid, and you’ll jamais voir HSTS itself on a rankings report soit façon.

Si you’re running the broader HTTP→HTTPS déplacer, HSTS is the dernier chose vous switch on, pas the premier — it belongs après the migration has settled, as partie of the wider migration de site discipline.

AI summary

A condensed prendre on the Avancé version:

• HSTS = the Strict-Transport-Security réponse header. It indique navigateurs to toujours utiliser HTTPS pour votre domain, closing the “first request problem” a 301 alone leaves ouvrir — the initial HTTP requête from a nouveau visitor is insecure jusqu’à the redirection fires, qui is the SSL-stripping window.
• Three directives: max-age (requis, seconds; resets on every réponse; removing the header doesn’t clair a learned policy — vous doit serve max-age=0 over HTTPS à la place), includeSubDomains (s’applique to tout subdomains), and preload (a flag to opt into le navigateur preload liste — token présent, eligible, submitted, and en réalité listed are four separate states).
• The internal-upgrade crux: quand a navigateur enforces HSTS it rewrites the URI to HTTPS internally avant quelconque requête reaches a server — RFC 6797 doesn’t mandate a spécifique code d’état pour que rewrite, though outils souvent montrer it as a 307 — so aucun server sees it and robots d’exploration jamais voir it. Votre serveur-side 301s are encore mandatory pour moteur de recherches and popularité des liens. HSTS is on top of votre 301s, jamais au lieu de les.
• Preload hardcodes votre domain into le navigateur via hstspreload.org (exige max-age ≥ 31536000, includeSubDomains, and preload). It’s fermer to irreversible — removal is a separate submission que takes months to reach utilisateurs, navigateur by navigateur.
• Designed to hard-fail: an HSTS host with a broken/expired cert refuses to charger, with aucun click-through. Google: “Don’t enable HSTS jusqu’à you’re certain votre site operation is robust suffisant to éviter ever deploying HTTPS with certificate validation errors.”
• Lockout scenarios cluster autour includeSubDomains and preload outrunning votre HTTPS coverage: forgotten HTTP subdomains, wildcard-cert depth gaps, lapsed certs, preload regret, and staging collisions.
• Pas a ranking signal — and can’t override canonicalization. Google prefers HTTPS as canonical except quand a cert is invalid, dependencies are insecure, an HTTPS page redirections to HTTP, or the balise canonical points to HTTP — and HSTS has aucun power to fix or override quelconque of que. Garder votre 301s, certificate, and canonical tags doing the SEO fonctionner.

Documentation officielle

Primary-source documentation from navigateur and standards teams.

Google / web.dev

• Enable HTTPS on votre serveurs (web.dev) — the HSTS section: the header, SSL-stripping, the hard-fail warning, and “don’t enable HSTS until you’re certain.”
• Site moves with URL changements — pourquoi le serveur-side 301 is encore mandatory (redirections don’t lose PageRank).
• Understanding page experience — où HTTPS (and by extension HSTS) sits in Google’s framing.

Standards & navigateur références

• MDN — Strict-Transport-Security — complet header syntax, the three directives, and how le navigateur upgrades the scheme.
• RFC 6797 — HTTP Strict Transport Security (HSTS) — the original specification.
• HSTS Preload Liste submission (hstspreload.org) — the exact preload requirements and the removal caveats, maintained by the Chromium project.

Quotes from the source

On-the-record statements from Google/web.dev and the Chromium preload service. Chaque lien jumps to (or points at) the quoted passage on the source page.

web.dev (Google) — ce que HSTS fait and the warnings

• “Use HTTP Strict Transport Security (HSTS) to avoid the cost of the 301 redirect.” Jump to quote
• “Premier, utiliser Strict Transport Security to tell clients ils devrait toujours connecter to votre serveur en utilisant HTTPS, même quand suivant an http:// référence. Ce defeats attacks comme SSL Stripping, and avoids the round-trip cost of the 301 redirection.” Jump to quote
• “Clients que have listed votre site as a connu HSTS Host are probable to hard-fail si votre site ever has an error in its TLS configuration, (tel as an expired certificate). HSTS is explicitly designed ce façon to garantir que network attackers can’t trick clients into accessing le site sans HTTPS.” Jump to quote
• “Don’t enable HSTS jusqu’à you’re certain votre site operation is robust suffisant to éviter ever deploying HTTPS with certificate validation errors.” Jump to quote

Chromium preload service — hstspreload.org

• “Be aware que inclusion in the preload liste ne peut pas easily be undone. Domains peut be supprimé, but it takes months pour a modifier to reach utilisateurs with a Chrome mettre à jour and we ne peut pas faire guarantees à propos de autre navigateurs.” Source
• “Don’t requête inclusion unless you’re certain que vous pouvez prise en charge HTTPS pour votre entier site and tout its subdomains in the long term.” Source

MDN — the header behavior

• “Avant chargement an http URL, le navigateur checks the domain nom contre its HSTS hosts liste. Si the domain nom is a cas insensitive match pour an HSTS host or is a subdomain of un que specified includeSubDomains, alors le navigateur replaces the URL scheme with https.” Source

Devrait I enable HSTS — and how far?

Walk it top to bottom. Chaque “no” is a arrêter sign, pas a maybe. Un distinction avant vous commencer: the exact max-age figures ci-dessous (a few minutes pour a canary, a année pour a resting state) are Patrick’s operational staging recommendations, pas protocol requirements — the seulement hard numeric requirement is hstspreload.org’s preload minimum (max-age ≥ 31536000), qui is appelé out explicitly at que step. Adjust the staging durations to votre propre risk tolerance and deployment cadence.

1. Is votre whole site déjà on HTTPS with a valid certificate, and has the migration settled?

• Aucun → Don’t touch HSTS yet. Finish the HTTPS migration premier: 301 every URL, fix mixed content, vérifier in Search Console. HSTS is the dernier switch, pas the premier.
• Yes → continuer.

2. Is votre certificate renewal automated and monitored (so a lapse can’t sneak up on vous)?

• Aucun → Fix que premier. On an HSTS host a lapsed cert is a hard outage, pas a warning. Obtenir auto-renewal + expiry alerting in placer, alors continuer.
• Yes → continuer. Enable a short max-age (e.g. a few minutes to a day) with aucun includeSubDomains yet, and confirmer nothing breaks.

3. Have vous audited every subdomain — notamment www, legacy apps, status pages, and vendor hosts — and confirmed chaque sert valid HTTPS?

• Aucun → Garder includeSubDomains off. Ajout it now voudrait reach bas and break quelconque HTTP-only or mismatched-cert subdomain.
• Yes → Raise max-age toward a année and ajouter includeSubDomains. Ce is a safe, strong resting state pour la plupart sites.

4. Do vous vouloir to fermer the premier-ever-visit gap aussi, and are vous certain you’ll jamais besoin to serve anything sous ce domain over plain HTTP à nouveau?

• Aucun / pas certain → Arrêter ici. max-age=31536000; includeSubDomains (aucun preload) is an excellent posture. Preload’s marginal gain isn’t worth its irreversibility si you’re unsure.
• Yes, certain → Ajouter the preload flag and submit at hstspreload.org. Treat it as permanent — removal takes months to reach utilisateurs.

Separate, always-true branch: fait enabling HSTS mean I peut drop my 301s?

• Jamais. Robots d’exploration don’t voir HSTS’s browser-only internal upgrade. Garder votre server-side 301s regardless of how far bas ce tree vous go.

HSTS rollout checklist

Fonctionner top to bottom — chaque stage gates the suivant. The staged durations ici are operational recommendations, pas protocol requirements — the seulement hard number is preload’s max-age ≥ 31536000 minimum in Stage 3.

Avant vous enable anything

• Entier site (apex + www + tout subdomains) sert HTTPS with a valid cert.
• HTTP→HTTPS 301 redirections are in placer server-side, one-to-one.
• Certificate auto-renewal is configuré and expiry monitoring/alerting exists.
• The HTTP→HTTPS migration has settled (Search Console clean, aucun ranking freefall).

Stage 1 — prove it’s safe

• Ajouter Strict-Transport-Security with a short max-age (minutes to a day).
• Aucun includeSubDomains yet. Aucun preload yet.
• Confirmer le site loads normally à travers navigateurs and que nothing broke.

Stage 2 — commit

• Raise max-age to au moins 31536000 (un année).
• Audit every subdomain (incl. www, legacy, status, vendor) pour valid HTTPS.
• Seulement après que audit passes, ajouter includeSubDomains.
• Re-test chaque subdomain loads over HTTPS.

Stage 3 — preload (optional, near-permanent)

• You’re certain you’ll jamais besoin HTTP sous ce domain à nouveau.
• Header is max-age=31536000 (or plus) ; includeSubDomains; preload.
• HTTP on port 80 redirections to HTTPS on the même host.
• Submit and confirmer status at hstspreload.org.

Toujours vrai — don’t skip

• Server-side 301s stay in placer (robots d’exploration jamais voir le navigateur-only internal upgrade).
• Vous have a documented rollback plan: max-age=0 served over HTTPS clears a learned (non-preloaded) policy pour clients que reconnect avant it would’ve expired anyway. Preloaded domains besoin the separate, slower removal-form traiter à la place.

The mental models

1. HSTS is a couche, pas a replacement. Server-side 301 = pour robots d’exploration and popularité des liens. Browser-side internal upgrade (from HSTS, souvent affiché as a 307 though the RFC doesn’t exiger que exact code) = pour returning humans and SSL-stripping protection. Différent audiences, différent jobs. Vous toujours besoin les deux; HSTS jamais subtracts a 301.

2. HSTS closes a gap the 301 can’t. A 301 protects the second requête onward. The premier requête — avant the redirection fires — is encore HTTP. HSTS (pour returning visitors) and preload (pour first-ever visitors) are the seulement choses que fermer que spécifique window.

3. Ratchet up, jamais jump. max-age short → long. Bare header → includeSubDomains (après a subdomain audit) → preload (seulement si certain). Every rung is reversible except the dernier. Don’t skip rungs to enregistrer temps.

4. Strictness is the fonctionnalité, and it cuts les deux façons. The même hard-fail que arrête an attacker aussi arrête vous quand a cert breaks. So the prerequisite isn’t “do you want security?” — everyone fait — it’s “is votre certificate operation robust suffisant to jamais échouer?”

5. Preload is a one-way door. Non-preloaded HSTS peut be relaxed pour a client the suivant temps it rend a secure requête and receives max-age=0 — aucun faster que que, and seulement pour clients who reconnect. Preload takes it a step plus loin: removal is a separate submission que takes months to reach utilisateurs, navigateur release by navigateur release. Put it in the “decisions we can’t easily take back” bucket and treat it accordingly.

6. HSTS is orthogonal to rankings — but can’t rescue a bad canonical signal soit. It’s pas a ranking signal and doesn’t directement contrôler canonicalization or indexation. Judge it on security and trust, pas on SEO upside — là isn’t quelconque. But it’s pas a safety net soit: Google’s HTTPS-canonical preference encore backs off pour a bad cert, insecure dependencies, an HTTPS→HTTP redirection, or an HTTP balise canonical, and HSTS has aucun power to override que.

HSTS — cheat sheet

The header directives

Courant header valeurs (staging figures ci-dessous are operational suggestions, pas protocol requirements — the hard minimum is the preload row)

Redirections: qui un, who sees it

Fast facts

• Preload exige max-age ≥ 31536000 + includeSubDomains + preload — verified contre hstspreload.org’s current publié requirements.
• Preload removal is a separate submission que takes months to reach utilisateurs, navigateur by navigateur — treat as permanent.
• On an HSTS host, a broken cert = hard-fail, aucun click-through.
• HSTS is pas a ranking signal and fait pas replace votre 301s.

Définir the HSTS header

Ajouter the header on votre HTTPS server block seulement, and commencer with a short max-age jusqu’à you’ve confirmed nothing breaks. Ajouter ; preload seulement quand vous intend to submit to hstspreload.org — it’s fermer to irreversible.

Apache (.htaccess)

<IfModule mod_headers.c>
  # Start short (300s) to prove it's safe; raise to 31536000 once confident.
  Header always set Strict-Transport-Security "max-age=300"
  # Full posture once every subdomain is verified HTTPS:
  # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  # Only add ; preload when submitting to hstspreload.org:
  # Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
</IfModule>

Nginx

# On the HTTPS (listen 443) server block:
add_header Strict-Transport-Security "max-age=300" always;
# Full posture once subdomains are verified:
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Preload shape (near-irreversible):
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Vérifier si HSTS is définir (and lire it back)

macOS / Linux

# Print only the Strict-Transport-Security response header
curl -sI https://example.com/ | grep -i strict-transport-security
# → strict-transport-security: max-age=31536000; includeSubDomains

Windows (PowerShell)

# Same check in PowerShell
(Invoke-WebRequest -Uri "https://example.com/" -Method Head).Headers["Strict-Transport-Security"]

Inspect and clair an HSTS entry in Chrome (DevTools / net-internals)

Si you’re testing and a navigateur has “learned” an HSTS policy vous devez clair:

1. Open a new tab and visit:  chrome://net-internals/#hsts
2. Under "Query HSTS/PKP domain", enter your host to see the stored policy.
3. Under "Delete domain security policies", enter the host and Delete.
   (This clears the *learned* policy — it does NOT remove a *preloaded* domain,
   which lives in the browser binary and can't be cleared this way.)

Utiliser ce to confirmer votre header is en réalité being stored, and to reset a tester host — pas as a fix pour production, où the réponse is to actively serve max-age=0 over HTTPS (simply removing the header doesn’t clair a policy a client déjà learned; it seulement takes effect une fois que client reconnects and receives the max-age=0 réponse).

HSTS mistakes que bite

1. Dropping votre 301s parce que “HSTS handles it.” The classic. HSTS’s redirection is a browser-only internal upgrade robots d’exploration jamais voir. Supprimer votre serveur-side 301s and moteur de recherches lose the signal que consolidates votre déplacer. Garder les deux, toujours.

2. Enabling includeSubDomains avant auditing subdomains. The unique la plupart courant façon to prendre a subdomain offline. Si quelconque subdomain — a legacy app, a status page, a vendor host, www itself — isn’t on valid HTTPS, the policy reaches bas and breaks it pour every navigateur que saw the header.

3. Jumping straight to a one-year max-age (or preload) on day un. Aucun safety net. Commencer short (max-age=300), confirmer nothing breaks, alors ratchet up. A long max-age définir on a misconfigured site is a self-inflicted outage que lingers in navigateurs pour a année.

4. Preloading avant HTTPS is genuinely bulletproof. Preload is near-irreversible — removal takes months. Google’s propre line: don’t enable HSTS jusqu’à you’re certain votre site operation is robust suffisant. Preload multiplies que stakes.

5. Treating a lapsed certificate as a minor problème. On a non-HSTS site an expired cert is a bypassable warning. On an HSTS host it’s a hard outage with aucun click-through. Si vous enable HSTS, cert renewal automation and expiry alerting arrêter being nice-to-haves.

6. Setting the header on the HTTP réponse. Navigateurs ignore HSTS delivered over HTTP (by design — an attacker pourrait inject or strip it). It doit be sent on the HTTPS réponse to count.

7. Forgetting the wildcard-cert depth limite. A *.example.com wildcard doesn’t cover foo.bar.example.com. Turn on includeSubDomains and quelconque deeper subdomain relying on que cert obtient locked out.

Incident playbook: an HSTS host is locked out

1. Confirmer the échec from a clean network and plus que un navigateur. Record the affected hostnames and the exact certificate error. A remembered HSTS policy peut faire the symptom differ entre returning and first-time visitors.
2. Restore valid HTTPS premier. Si the certificate is expired, mismatched, or manquant an intermediate, renew or replace it and deploy the complet chain. An HSTS navigateur ne va pas offer a safe HTTP bypass.
3. Map the policy scope. Inspect the live Strict-Transport-Security header and determine si includeSubDomains or preload extends the outage au-delà the hostname que sent it.
4. Inventory every affected subdomain. Pour a forgotten HTTP-only host, put a valid certificate and HTTPS endpoint in front of it avant deciding si to garder, migrate, or redirection the service.
5. Correct the policy seulement après accès is restored. Si the scope is unsafe, reduce or supprimer the header on HTTPS réponses. Que ne fait pas instantly clair a policy déjà mis en cache by navigateurs, and preload removal is a separate, slow traiter.
6. Vérifier recovery. Tester the apex, www, and chaque affected subdomain pour a valid chain, correct hostname, one-hop HTTP→HTTPS redirection, and the intended HSTS header. Garder certificate-expiry monitoring on the même inventory.

Ne faites pas tear bas the HTTP redirection or tell utilisateurs to bypass the warning. The durable fix is a valid HTTPS endpoint everywhere the active HSTS policy reaches.

Audit a live HSTS policy

Act as a security-minded technical SEO. Review this Strict-Transport-Security
header, the HTTP redirect response, and the supplied subdomain inventory.

For the header, parse max-age, includeSubDomains, and preload. Explain the effective
scope, identify subdomains whose HTTPS or certificate coverage is unproven, and
separate browser-side HSTS behavior from the server-side 301 search engines need. Use
GET requests (HEAD can behave differently on some servers/clients), and record which
client or tool produced each observation and its version, since internal-redirect
representation is client/tool-specific rather than a fixed protocol value.

Recommend the next rollout stage: keep a short max-age canary, lengthen max-age,
add includeSubDomains, or consider preload. Do not recommend preload unless the
evidence shows a valid certificate, same-host HTTP→HTTPS redirects, HTTPS on every
subdomain, max-age of at least 31536000, includeSubDomains, and the preload token.

Return: observed configuration, risks, blocking evidence, next action, rollback
constraint, and exact validation checks.

Triage an HSTS lockout

Given the affected hostnames, browser error, certificate details, DNS/CDN layout,
and live response headers, identify whether this is an expired certificate, hostname
mismatch, incomplete chain, includeSubDomains spillover, or preload issue. Prioritize
restoring valid HTTPS. Explain why removing a header does not immediately erase a
cached browser policy, then provide recovery and verification steps.

HSTS inspection toolkit

• HTTP Header Checker — inspect the live Strict-Transport-Security header and confirmer it apparaît on HTTPS réponses.
• curl -I — comparer the HTTP redirection with the HTTPS header sans relying on a browser’s remembered HSTS state.
• Navigateur DevTools — confirmer the final réponse headers and certificate error seen by a réel client.
• HSTS preload status — vérifier submission requirements and si the domain is déjà represented in the preload traiter.

Utiliser au moins two views: command-line output montre le serveur réponse, pendant que a navigateur aussi exposes client-side enforcement and certificate hard échecs. Préférer OBTENIR over HEAD quand comparing outils — some servers and clients represent the two differently — and remarque the exact client/outil/version behind every reading.

Staged HSTS rollout tests

Tester 0: the state matrix (run ce avant staging changements)

HSTS status isn’t un fact — it’s several independent states que peut disagree. Track les separately, per hostname:

Record the client, outil, and version pour every observation — internal-redirect representation and HSTS enforcement details vary à travers navigateurs, robots d’exploration, and command-line outils, and a stale reading from un client peut regarder comme a contradiction que isn’t réel.

Tester 1: short max-age canary

• Objectif: Prove the header is emitted seulement from sain HTTPS réponses avant committing clients to a long policy.
• Méthode: Inspect representative templates and hosts with the HTTP Header Checker and curl -I; comparer the deployed valeur with the approved canary configuration.
• Attendu result: HTTPS réponses carry the intended short max-age; HTTP encore renvoie a server-side redirection permanente to HTTPS.
• Échec trigger: Manquant or duplicated headers, an unexpected long duration, certificate errors, or quelconque boucle de redirections.
• Suivant action: Fix the header or HTTPS endpoint and garder the rollout at the canary stage.

Tester 2: includeSubDomains readiness

• Objectif: Prevent a parent policy from locking out a forgotten hostname.
• Méthode: Tester every DNS hostname in the maintained subdomain inventory pour a valid HTTPS réponse, correct certificate nom, and complet chain.
• Attendu result: Every in-scope subdomain fonctionne over HTTPS, notamment legacy, vendor, development, and deeper-level hosts.
• Échec trigger: Quelconque HTTP-only service, expired or mismatched certificate, or hostname manquant from the inventory.
• Suivant action: Remediate or relocate the host avant ajout includeSubDomains.

Tester 3: preload readiness

• Objectif: Vérifier the near-permanent policy satisfies the documented submission requirements.
• Méthode: Confirmer a valid certificate, same-host HTTP→HTTPS redirections, HTTPS on tout subdomains, and an apex header with max-age of au moins 31536000, includeSubDomains, and preload.
• Attendu result: Every requirement passes and the organization accepts the slow removal chemin.
• Échec trigger: Quelconque failed technical requirement or an unresolved besoin pour an HTTP-only subdomain.
• Suivant action: Ne faites pas submit; remain on the reversible staged policy.

Ressources utiles

My speaking

• Meilleur Safe Que Sorry with HTTPS — SMX East 2016 (SlideShare) — my deep-dive on TLS, courant HTTPS implementation échecs, and the migration gotchas que HSTS les deux closes and peut amplify. (Standing disclaimer s’applique: it’s my understanding of ces systems, and the adoption stats in it are from 2016.)

My connexe writing

• The Beginner’s Guide to SEO technique — où HTTPS and HSTS fit in the bigger picture.

From autour the industry

• Enable HTTPS on votre serveurs (web.dev) — Google’s propre HSTS guidance: the header, SSL-stripping, and the hard-fail warning.
• MDN — Strict-Transport-Security — the authoritative header référence: syntax, directives, and scheme-upgrade behavior.
• HSTS Preload Liste submission (hstspreload.org) — the Chromium project’s preload requirements and the near-irreversibility caveats.
• RFC 6797 — HTTP Strict Transport Security — the original specification, pour quand vous besoin the exact wording of a directive.
• HSTS — Ce que c’est and Comment utiliser It (Kinsta) — a practical implementation guide covering le navigateur-level internal redirection, the preload liste, and the lock-in risks.
• SSL Labs Server Tester (Qualys) — grade votre TLS configuration and confirmer HSTS is being served correctement.

Stats and hard facts worth citing

• Preload exige max-age ≥ 31536000 (1 année), includeSubDomains, and preload. The exact, non-negotiable submission bar pour le navigateur-baked liste. Source
• Preload removal takes months to reach utilisateurs. From the submission service: “inclusion in the preload liste ne peut pas easily be undone… it takes months pour a modifier to reach utilisateurs with a Chrome mettre à jour.” Ce is the number que rend preload a one-way door. Source
• HSTS hosts hard-fail on quelconque TLS error. web.dev: clients que know votre site as an HSTS host “are probable to hard-fail si votre site ever has an error in its TLS configuration.” Aucun click-through — a lapsed cert becomes an outage. Source
• HTTPS itself is “a very lightweight signal—affecting fewer que 1% of global requêtes.” Google’s propre framing — and HSTS is a couche on top of HTTPS, pas a separate ranking input, so its SEO weight is effectively zero. Right-size expectations accordingly. Source

Testez vos connaissances: HSTS

Five rapide questions on HSTS. Pick an réponse pour chaque, alors vérifier.

Journal des modifications