What max-age is required for preload?

At least 31536000 seconds (one year), per the HSTS preload list requirements.

Is my domain registered with preload from this tool?

No. The builder only produces the header. Preload submission is a manual step at hstspreload.org after you have served the header from your live site.

Why is preload risky?

Once your domain is in the preload list shipped with browsers, removing it takes months to years. Make sure HTTPS is fully working across all subdomains before enabling includeSubDomains and preload.

Is my configuration sent anywhere?

No. The header string is built locally and shown in your browser.

hsts · preload · subdomains · https-only

Build a HSTS response header

Compose Strict-Transport-Security with the right max-age and preload-list eligibility. Assembly runs locally in your browser.

HSTS Builder

max-age

63072000

Subdomains

scope

Preload

browser list

Length

71 B

71 chars

input · directives

max-age (seconds)~ 2 yearsincludeSubDomainspreload — include in HSTS preload list

Submit to hstspreload.org after verifying the header in production.

output · header

Strict-Transport-Security

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Quick Start

How to roll out HSTS

HSTS forces browsers to use HTTPS for your domain. Long max-age is sticky — test carefully before committing.

01
Test short
Start with a 5-minute max-age in staging. Easy to back out.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
testIANAregistryofflinelive
max-age · query300s · IANA
```
max-age=300
```
loaded · IANA bundlespec · ready
02
Ramp to 1 year
Bump max-age to 31536000 once HTTPS works everywhere.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
rampRFC 9110canonicalspec-compliantlive
max-age · options1y · live
```
max-age=31536000
```
options applied · livecanonical
03
Add subdomains
includeSubDomains covers every host under your apex.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
scopevalidationlintpitfallslive
scope · looked upall · ready
```
includeSubDomains
```
result · livevalidated
04
Submit preload
Submit your domain at hstspreload.org once 2-year preload is live.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
shipclipboardMIME-correctblobcurl-ready
ok · copiedpreload · done
```
preload
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to enable HSTS

Lock down HTTPS, prevent SSL stripping, prep for preload.

SSL stripping

Block on-path attackers downgrading TLS. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Preload list

Browsers ship with your domain hard-coded HTTPS. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Subdomain coverage

One header locks every subdomain to HTTPS. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Compliance

PCI DSS and many corp policies require HSTS. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Long-lived sites

Year+ max-age is the de-facto production setting. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

CDN config

Set at the edge for instant rollout to every page. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why so cautious?

Once a browser caches HSTS, it'll refuse plain HTTP for the duration of max-age. If certificates lapse, users hit a wall — test short first.

What is preload?

Browsers ship with a hard-coded list of HSTS domains. Inclusion is sticky — removal takes months to propagate.

Do I need a wildcard cert?

If includeSubDomains is set, every subdomain must serve valid HTTPS. Wildcard or per-host certs both work.

Can I clear HSTS?

Browsers expose a way (chrome://net-internals/#hsts) but you can't force it on users — only your own machine.

Is anything sent to a server?

No — header assembly runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!