Skip to content

hsts

Jump to bottom
ninabarzh edited this page Jan 24, 2022 · 1 revision

Correctly configured HSTS

  • The Web server sends the HSTS response header. It appears in the response header as:
Strict-Transport-Security: max-age=expireTime [; includeSubdomains] [; preload]
  • The Web browser understands the HSTS response header. Older web browsers do not, but most now do and it is part of the web browser configuration at installation (or upgrade) making HSTS status for websites preloaded into the browsers. The preload status for a particular website can be checked at https://hstspreload.org/ website.
  • The initial HTTP request to the root domain is immediately be redirected to HTTPS to the root domain, before redirecting to the "www" subdomain.
  • In the HSTS response header for the first HTTPS request, the includeSubDomains directive is specified, the preload directive is specified, and the max-age is at least 31536000 seconds (1 year).
Clone this wiki locally