HSTS Header Builder

HSTS instructs the browser to reach that domain over HTTPS only, for as long as the header declares. The gain is closing the first-visit window: without it, someone typing the address without a scheme makes one cleartext request before the redirect, and that request is where a network attack fits.

Choose the duration and the two options and the page assembles the header. The common value is one year, and the reason it runs so long is that the effect only exists for people who already visited — a short window means the browser forgets and the gap reopens. The subdomains option extends the rule to everything beneath the domain, and the preload flag signals intent to join the list built into browsers.

The care required scales with the duration: the header cannot be undone remotely. Shipping it with subdomains included takes down any subdomain still serving plain HTTP — an internal system, an old environment, a forgotten panel — and the browser of anyone who already visited will refuse for a year. The safe practice is shipping with a short duration, confirming everything answers over HTTPS, and only then raising it.