Skip to content
RankThat

HSTS

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to only ever connect to your site over HTTPS, even if someone types or clicks an http:// link.

Redirecting HTTP to HTTPS has a small gap. The very first request, before the redirect, still goes over unencrypted HTTP, and someone on the same café Wi-Fi could interfere with it. HSTS closes that gap. Once a browser has seen the header on your site, it remembers to use HTTPS for every future visit, without asking the server first.

The header

Strict-Transport-Security: max-age=31536000; includeSubDomains
  • max-age is how long, in seconds, the browser should remember the rule. 31536000 is one year.
  • includeSubDomains applies the rule to every subdomain as well.
  • preload (optional) signals that you want the domain added to the HSTS preload list built into browsers, so even a first visit uses HTTPS.

Why it matters

For SEO, HSTS isn’t a ranking factor. It’s a security and trust measure, and it also saves a redirect hop for returning visitors, since the browser switches to HTTPS internally. For a business taking bookings or payments, like Brightside Dental or Bean & Barrel Coffee, it’s part of keeping visitors’ data safe and is often required by security scans run by payment providers and insurers.

Rolling it out safely

HSTS is hard to undo. If you enable it and later a subdomain can’t serve HTTPS, browsers will refuse to load that subdomain until max-age expires. So:

  1. Make sure the whole site, and every subdomain if you’ll use includeSubDomains, works over HTTPS with a valid certificate.
  2. Start with a short max-age, such as 300 seconds (five minutes), and check nothing breaks.
  3. Increase to a week, then a month, then a year.
  4. Only submit to the preload list (hstspreload.org) when you’re sure. It requires a max-age of at least one year, includeSubDomains and preload, and removal takes months to reach users.

Common mistakes

  • Turning on includeSubDomains while an old subdomain (say, mail.example.com or a staging site) still runs on HTTP only.
  • Sending the header over HTTP. Browsers ignore HSTS headers that don’t arrive over HTTPS.
  • Adding HSTS before fixing mixed content, then chasing broken images and scripts.

How to check

Run curl -I https://www.example.com/ and look for the strict-transport-security line. RankThat’s Site Audit flags a missing HSTS header along with other missing security headers. On WordPress, the Bridge plugin can add security headers as a fix you review first and can undo in one click.

Do this month’s SEO in an afternoon.

Start free trialCheck a site free