---
title: "Make browsers always use HTTPS · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/hsts
updated: 2026-10-20
licence: "All rights reserved"
---

# Make browsers always use HTTPS

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Send `Strict-Transport-Security` so browsers always use HTTPS. Give it a long `max-age` (at least a year) and `includeSubDomains`, on HTTPS responses only.
- How: Start with a short `max-age`, such as 300 seconds. Once nothing breaks, set it to 63072000, which is two years. Add `includeSubDomains` once every subdomain serves HTTPS. Send the header from the web server with `always`, so error responses carry it too. Add `preload` and submit the domain to the browser preload list only when you are sure, because leaving the list takes months.
- Check: `curl -sI https://example.com/` and a missing page both show the header with `max-age` of at least 31536000. `curl -sI http://example.com/` shows no such header.

Example:

```http
HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains
```

```nginx
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/hsts`.

- Next: [Load nothing over plain HTTP](https://agentwranglers.se/playbook/website/security/mixed-content)
- [Security](https://agentwranglers.se/playbook/website/security)