Strict-Transport-Security (HSTS): max-age, includeSubDomains, preload

Strict-Transport-Security: max-age=63072000; includeSubDomains tells browsers that, for the next two years, this host must be reached only over HTTPS: http:// links are upgraded before any request is sent, and certificate errors cannot be clicked through. Browsers ignore the header when it arrives over plain HTTP.

See a real header

curl -sI https://github.com/ | grep -i '^strict-transport-security'

Strict-Transport-Security: max-age=31536000; includeSubdomains; preload

Directives

Roll it out safely

1. Make every subdomain work over HTTPS first.
2. Start with a short max-age (for example 300), check that nothing breaks, then raise it to one or two years.
3. Add includeSubDomains only when all subdomains serve HTTPS.
4. Add preload and submit the domain only if you will keep HTTPS forever: removal from the preload list takes months.

Server examples

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"