HSTS Header Builder

HSTS has three parameters and most people copy them from Stack Overflow without knowing what each one does. Here you pick a max-age in seconds, decide whether subdomains are included and whether preload is set, and get the finished Strict-Transport-Security line. Defaults are 31536000 seconds, which is one year, with includeSubDomains turned on.

The detail that catches people out: browsers only honour HSTS when the header arrives over a valid HTTPS connection. Sending the same header on a plain HTTP response does nothing at all. The max-age clock also restarts on every visit, so a frequent visitor stays pinned to HTTPS more or less forever. The yes/no fields expect the Portuguese word sim to switch a flag on, and anything else counts as off. Leave max-age empty and you get max-age=0, the official way to switch HSTS off.

Think twice before ticking preload. It puts your domain on a list compiled into browser binaries, removal takes months, and it only reaches users who update. Before that, make sure every subdomain works over HTTPS, including intranet hosts, staging and that old admin panel. The builder assembles the string but does not validate the preload prerequisites, so confirm them at hstspreload.org. In nginx and Apache you configure the header name and value separately, so copy only the part after the colon.