HSTS enforces browsers to access resources exclusively via HTTPS within a specified period.
- Configuration Parameters
Strict-Transport-Security: max-age=<seconds> [; includeSubDomains] [; preload]
– max-age (Required): Expiration time (in seconds). The client is forced to use HTTPS during this period.
– includeSubDomains (Optional): Applies HSTS to the domain and all its subdomains.
– preload (Optional): Requests inclusion in the browser’s built-in HSTS list, enforcing HTTPS even before the first visit.
- Configuration Recommendations
1. Gradually increase max-age to avoid disrupting normal operations. A minimum of 31536000 (1 year) is recommended for production.
– 5 minutes → max-age=300;
– 1 week → max-age=604800;
2. includeSubDomains should be enabled cautiously, ensuring all subdomains fully support HTTPS.
3. Preload has strict requirements, requires manual submission and approval, and is difficult to remove. Use with caution.
- Configuration Examples
Strict-Transport-Security: max-age=31536000;
Strict-Transport-Security: max-age=31536000; includeSubDomains;