What is HSTS (HTTP Strict Transport Security)?
HSTS is a security header that tells browsers to always use HTTPS for a site, preventing downgrade attacks and insecure first requests.
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to connect to your site only over HTTPS for a set period. After the first visit, the browser upgrades any http:// link itself, before a request is sent.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains
max-ageis how long, in seconds, the browser remembers the rule. Six months or more is recommended.includeSubDomainsapplies the rule to every subdomain, so make sure they all support HTTPS.preloadasks to be included in browsers' built-in HSTS lists. Removal takes months, so add it only when you are sure.
Related
- Security headers checker
Free security headers checker. Test HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, SSL certificate expiry, TLS version and mixed content.
- What is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP header that tells browsers which sources of scripts, styles and other resources a page may load, limiting the damage of cross-site scripting.
- What are source maps, and are public source maps a risk?
Source maps are .map files that map minified JavaScript back to the original source code. Publicly served production source maps expose your full front-end source.