Agent Wranglers

Security Required

Make browsers always use HTTPS

Send Strict-Transport-Security so browsers always use HTTPS. Give it a long max-age (at least a year) and includeSubDomains, on HTTPS responses only.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Start with a short max-age, such as 300 seconds, and raise it once nothing breaks. Add includeSubDomains once every subdomain serves HTTPS. Add preload and submit the domain to the browser preload list only when you are sure, because leaving the list takes months.

Example

HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains

How to check

curl -sI https://example.com/ shows the header. HTTP responses don't.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/hsts.