HTTP Strict Transport Security (HSTS) is a web security policy that tells browsers to only connect to your site over HTTPS, preventing downgrade attacks and cookie hijacking.

What max-age value should I use?

For production sites, at least 1 year (31536000 seconds) is recommended. For HSTS preload list submission, 2 years (63072000 seconds) is the recommended minimum.

What does includeSubDomains do?

When set, the HSTS policy applies to all subdomains as well. Only enable this if every subdomain serves valid HTTPS — otherwise some subdomains may become unreachable.

What is the preload flag?

The preload directive signals your intent to be included in browser HSTS preload lists. Preload requires max-age of at least 31536000 (1 year) and includeSubDomains must also be set.

Can I remove HSTS once set?

Yes, but browsers cache the header for the duration of max-age. To remove HSTS quickly, serve the header with max-age=0. If you submitted to the preload list, removal can take months.

HSTS Header Generator

Configure max-age, includeSubDomains, and preload options to generate a ready-to-use Strict-Transport-Security header with server config snippets.

Configure HSTS Header

max-age (seconds)

Presets

includeSubDomains

Apply HSTS to all subdomains

preload

Signal intent for HSTS preload list inclusion

Generated Header

Strict-Transport-Security: max-age=31536000

Server Config Snippets

Copied!

Summary

The HSTS Header Generator helps you create a correctly formatted Strict-Transport-Security header. Choose from common max-age presets or enter a custom value, toggle includeSubDomains and preload options, and instantly get server configuration snippets for Nginx, Apache, Caddy, and Node.js/Express.

How it works

The tool assembles the Strict-Transport-Security header value from your chosen options entirely in the browser. It validates preload requirements (max-age >= 31536000 and includeSubDomains must be enabled) and generates ready-to-use server configuration blocks.

Use cases

Enforce HTTPS on all visitors and prevent SSL-stripping attacks.
Prepare a domain for submission to the HSTS preload list.
Generate server configuration snippets for DevOps deployments.
Audit and validate existing HSTS header settings.

Frequently Asked Questions

Last updated: 2026-06-13 · Reviewed by Nham Vu