HSTS and Preload: Protecting Your Site Against SSL Stripping

Even if your site has a valid SSL/TLS certificate, when a user types http://yoursite.com the first request goes out unencrypted. That brief moment lets an attacker intercept the traffic (man-in-the-middle) or prevent the upgrade to HTTPS and keep the connection on HTTP (SSL stripping). HSTS is the HTTP response header that closes exactly this gap.

What HSTS does

HSTS (HTTP Strict Transport Security) tells the browser: “from now on, connect to this domain only over HTTPS, and never try HTTP.” The browser remembers this; even if the user types http://, the request is converted to HTTPS before it leaves the device.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

• max-age (required): how many seconds the browser remembers the rule. Two years (63072000) is common in production.
• includeSubDomains: applies to all subdomains — make sure they all serve HTTPS first.
• preload: the strongest level. It gets your domain into browsers’ built-in HSTS list, so the browser uses HTTPS even on the very first visit.

Note: the HSTS header is only honoured on HTTPS responses; sent over HTTP it is ignored.

How preload works, and why to be careful

With normal HSTS, protection starts after the user has visited over HTTPS at least once; the first visit is still exposed. Preload solves this via hstspreload.org: your domain ships built into browsers. But preload is a commitment — removal can take months. Before applying, ensure a valid certificate, HTTPS redirects for all traffic, HTTPS on every subdomain, and max-age of at least one year with includeSubDomains and preload.

Safe rollout order

1. Set up the HTTP → HTTPS redirect (301).
2. Start with a short max-age (e.g., 300) so you can back out quickly.
3. Increase max-age, then add includeSubDomains once every subdomain is verified.
4. When stable, add preload and submit to hstspreload.org.

Verify it with curl -sI https://yoursite.com | grep -i strict-transport-security.

Summary

HSTS closes the gap between “I have a certificate” and “my connection is always actually encrypted,” stopping SSL stripping. The correct order is: HTTPS redirect → short max-age → long max-age → includeSubDomains → preload.

Sources: MDN: Strict-Transport-Security, hstspreload.org, OWASP HSTS Cheat Sheet.

Want to check your HSTS, certificate and HTTPS redirect configuration? CyberTestify’s external surface scan verifies these headers from real captured responses.