HSTS headers with subdomains and preloadWhat it checks and how to fix it

What it checks

Fetches the homepage and reads Strict-Transport-Security. No header fails. A max-age under one year (31536000 seconds), or a header missing includeSubDomains or preload, gets a warning. A complete header is then looked up on hstspreload.org: preloaded passes, pending or not listed gets a warning.

Why it matters

Without HSTS, a visitor's first request can go over plain HTTP, and an attacker on the same network can intercept it and keep them on HTTP (SSL stripping). HSTS tells the browser to only ever use HTTPS for your domain. Being on the preload list protects even the very first visit, because the browser ships knowing your domain is HTTPS-only.

How to fix it

Send the header on every HTTPS response, then submit the domain at hstspreload.org. Only add includeSubDomains once every subdomain serves HTTPS, and keep in mind preloading is hard to undo.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

nginx

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Apache

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

Cloudflare: SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) → enable, set Max Age to 12 months or more, turn on Include subdomains and Preload.

Rails (config/environments/production.rb)

config.force_ssl = true
config.ssl_options = { hsts: { expires: 2.years, subdomains: true, preload: true } }