HSTS (HTTP Strict Transport Security)
A security header that forces browsers to always use HTTPS for your site.
HTTP Strict Transport Security (HSTS) is a response header telling browsers to reach your site only over HTTPS, for a stated period. It closes the gap where a first plain-HTTP request could be intercepted before the redirect happens. Add it once HTTPS works everywhere, because it makes the choice hard to reverse.
Definition
HSTS is a security header that tells browsers to only connect to your site over HTTPS. Once a browser receives an HSTS header, it will automatically convert all HTTP requests to HTTPS for the specified duration — even before making a connection.
HSTS preload takes this further — your domain gets hardcoded into browsers so even the very first visit uses HTTPS.
Across every site SlapMyWeb has audited, 57.8% send HSTS — which leaves 42.2% with no HSTS header.
Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.
Why It Matters
Without HSTS, the first visit to your site might be over HTTP (before the redirect kicks in), creating a window for SSL stripping attacks. HSTS eliminates this vulnerability entirely.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadThis tells browsers to use HTTPS for 1 year, including all subdomains, and is eligible for the HSTS preload list.
Related Terms
Related Tools
Know the term.
Check your own site.
A free audit tells you whether this is currently costing you score points — and exactly what to change.
Run a free audit