When convenient

Your site lets browsers fall back to an insecure connection

What it means

Your site has a secure address (https) and probably redirects visitors there from plain http. But the first request, when someone types your name or follows an old link, can still go out over plain http before the redirect kicks in.

HSTS is a short instruction your site sends with every secure page. It tells the browser: for the next so many seconds, only ever connect to this site over https, and do not even try plain http. The browser remembers that and upgrades every later visit on its own.

The header looks like Strict-Transport-Security: max-age=31536000. The number is how long the browser should remember, in seconds. 31536000 is one year.

Why it matters

Without HSTS, someone on the same network as your visitor, such as a coffee shop or hotel Wi-Fi, can catch that first plain http request and keep the visitor on an insecure copy of your site. The visitor sees your pages but no padlock, and anything they type can be read or changed on the way.

It is not an emergency, and your site is not broken. EverThread rates it as a fix to make when convenient.

There is one thing to understand before you turn it on. Once a browser has seen HSTS, it will refuse to load your site over plain http until the time runs out. If your certificate ever expires or breaks, visitors will not get the usual option to click past the warning. That is the point of HSTS, but it means your https setup needs to be reliable first.

How to check your own site

1. Open your home page in Chrome, Edge or Firefox. Right-click the page, choose Inspect, and open the Network tab.
2. Reload the page. Click the first row in the list, which is the page itself, and look at the Response Headers section.
3. Look for strict-transport-security. If it is not there, the header is missing. If it is there, note the max-age value.
4. Make sure the address bar shows https://. Browsers ignore HSTS on plain http pages, so the header only counts on the secure version.

How to fix it

Any website

1. Before you start, make sure every page on your site loads over https and that plain http redirects to https. If it does not, fix that first.
2. Add the header with a small value, such as max-age=300 (five minutes). Browse your site, including forms, checkout and any login pages, and make sure everything still works.
3. Raise it in steps: a day (max-age=86400), then a week (max-age=604800), then a year (max-age=31536000). A year is the usual long-term setting.
4. Leave out includeSubDomains at first. It applies the rule to every subdomain, such as shop., mail. or an old staging. address, and any of those without working https would become unreachable. Most small business sites are well protected without it.
5. Leave out preload unless you are sure. It asks browser makers to build your domain into the browser itself, and taking it back out can take months.

WordPress

1. Headers are usually best set at the server or CDN, not inside WordPress. That way they apply to every file, not just pages WordPress builds.
2. Check your host's dashboard first. Many managed WordPress hosts have a setting for HSTS or security headers. Names vary, so search their help pages for "HSTS".
3. If your host runs Apache, you can add the line from the Apache section below to the .htaccess file in your site's main folder.
4. A plugin is the fallback. Search the plugin directory for "security headers", pick one that is actively maintained, and set a short max-age to start.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms run the servers, so you usually cannot add or change headers yourself. Many handle https and HSTS for you.
2. Look for an HSTS option in the SSL or security settings. Squarespace, for example, has one. Menu names vary by platform and plan.
3. If there is no setting, there is nothing for you to change. You can ask the platform's support whether they plan to add it. Putting your own CDN in front of a hosted builder is often not supported, so ask before trying.

Cloudflare

1. Make sure your site has a working certificate and that "Always Use HTTPS" is on, under SSL/TLS, Edge Certificates.
2. On the same page, find HTTP Strict Transport Security (HSTS) and choose to enable it. Cloudflare shows a warning explaining the risks. Read it, then continue.
3. Turn on HSTS and pick a short Max Age if one is offered. Leave "Apply HSTS policy to subdomains" and "Preload" off for now. Save.
4. This only covers traffic that goes through Cloudflare, shown as an orange cloud next to the record in your DNS settings.

Apache (.htaccess)

1. Add these lines to the .htaccess file in your site's main folder, or to the https virtual host in your server settings. This needs the mod_headers module, which most hosts have on.
2. Browsers ignore the header on plain http, so it is fine if Apache sends it there too.

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=300"
</IfModule>

Nginx

1. Add this line inside the server block that listens on port 443, then reload Nginx.
2. The word always makes Nginx send it on error pages as well.

add_header Strict-Transport-Security "max-age=300" always;

What to send your developer

Send Strict-Transport-Security on HTTPS responses and ramp max-age from 300 to 31536000 over a few weeks. Add includeSubDomains only after auditing every subdomain for valid TLS. Treat preload as a one-way door: it requires max-age of at least a year plus includeSubDomains, and removal from browser preload lists is slow. In Nginx, an add_header inside a location block stops the server-level ones from being inherited, so repeat security headers there or set them in one shared include. Confirm with curl -sI https://example.com/. See MDN on Strict-Transport-Security.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Common questions