Safe HSTS deployment

Begin with a short duration and verify every stage.
Staged HSTS deployment

Start with a short duration and increase it only after testing

The certificate, canonical HTTPS address and permanent HTTP redirect must work first. The safest route is to ask hosting support for HSTS without preload or subdomain coverage.

HSTS is deployed in stages with a backup, increasing duration, subdomain checks and rollback
A short duration allows an incorrect policy to expire before it becomes a long-term lock.

Message for support

Hello,
HTTPS and the HTTP redirect work for example.com.
Please enable one Strict-Transport-Security header.
Start with a short max-age without preload
or includeSubDomains, then increase it after testing.
Do not cover subdomains without approval.

Safe sequence

  1. Set max-age=300 and test the main site.
  2. Increase it to a week, then a month while monitoring operation.
  3. After successful testing, set a long duration such as one year.
  4. Add includeSubDomains only after checking every subdomain.
  5. Do not enable preload automatically; assess it separately.
  6. After each stage, confirm one header on key HTTPS responses.

Technical examples

Apache / .htaccess

Header always set Strict-Transport-Security \
"max-age=300"

Nginx

add_header Strict-Transport-Security \
"max-age=300" always;

One header from one configuration layer

Do not add HSTS simultaneously in a CDN, panel, Nginx and .htaccess. Duplicate policies can conflict. Send the header over HTTPS only.

When preload is appropriate

Only after extended testing of the main site and every subdomain. Submission requires at least max-age=31536000, includeSubDomains and preload, but the directive itself does not add the domain to the list. Removal can take months.

After configuration, perform an independent HSTS check.

An Automatic check is available at the top of this page. You can independently confirm its result using the manual verification instructions, then fix the issue yourself or order a professional fix.