APS-23Required

Make browsers always use HTTPS

Send Strict-Transport-Security so browsers always use HTTPS. Give it a long max-age (at least a year) and includeSubDomains, on HTTPS responses only.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Start with a short max-age, such as 300 seconds. Once nothing breaks, set it to 63072000, which is two years. Add includeSubDomains once every subdomain serves HTTPS. Send the header from the web server with always, so error responses carry it too. Add preload and submit the domain to the browser preload list only when you are sure, because leaving the list takes months. Encrypt every other connection too, as Encrypt data on the wire and on disk says.

Examples

HTTP example

HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains

nginx example

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

How to check

curl -sI https://example.com/ and a missing page both show the header with max-age of at least 31536000. curl -sI http://example.com/ shows no such header.

Sources

RFC 6797: HTTP Strict Transport Security

APS-54 Encrypt data on the wire and on disk in Application security

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/hsts">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.