What is HSTS? max-age, includeSubDomains and preload
HSTS is the Strict-Transport-Security header that tells browsers to use only HTTPS for a host. max-age, includeSubDomains, preload and how to roll it out.
HSTS, HTTP Strict Transport Security, is a response header, Strict-Transport-Security, that tells browsers to reach a host only over HTTPS for a set period.
It is defined in RFC 6797. After a browser has seen the header, it upgrades every later http:// request to that host to HTTPS before sending it. MDN adds that it also stops the user from clicking through a certificate error on that host. max-age sets how long the rule lasts in seconds, includeSubDomains extends it to every subdomain, and preload signals consent to the browser preload list run at hstspreload.org. That list is not part of the HSTS specification. A browser ignores the header when it arrives over plain HTTP.
Category: Security
Why it matters
A redirect from HTTP to HTTPS still leaves the first request in the clear, and an attacker on the network can answer that request before the redirect happens. HSTS closes the gap for every visit after the first, because the browser never sends the HTTP request at all. The preload list closes it for the first visit too, since browsers ship with the list built in. Mistakes are costly in the other direction. includeSubDomains on a domain with an HTTP-only subdomain makes that subdomain unreachable for the length of max-age, and removing a preloaded domain from the list takes months.
How squirrelscan checks it
security/hsts reads the headers of the first crawled page, so the verdict covers the site rather than each page. It reports at info level when that page is not HTTPS, since the header would be ignored. It warns when the header is missing, when it has no valid max-age, when max-age=0 tells browsers to drop the policy, and when max-age is below 15,768,000 seconds, about six months. A longer max-age passes. The rule does not check whether the domain is on the preload list. It is skipped on localhost and private-network hosts.
| Rule | What it flags | Severity |
|---|---|---|
| HSTS: what Strict-Transport-Security needs to be valid | A missing or short Strict-Transport-Security header leaves the first request downgradeable. squirrel reads the header and checks max-age. | warning |
How to fix it
Send the header from the HTTPS origin, not from the HTTP redirect:
Strict-Transport-Security: max-age=31536000; includeSubDomains
Start with a short max-age while you confirm that every subdomain serves HTTPS, then raise it to a year (the HSTS fix). Add preload and submit the domain at hstspreload.org only once you are sure, because getting it off the list again is slow.
Run the check
squirrel audit https://example.com --rule-include security/hstsA signed-out local audit costs nothing.
Related terms
- HTTPS: HTTP over TLS, which encrypts traffic and proves the server’s identity; every page and form should use it.
- Security headers: HTTP response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) that tell browsers to restrict risky behaviour.