Correction guide
Configure HSTS without locking visitors out
HSTS tells the browser to return over HTTPS. Mistakes can remain stored: verify the affected hosts first and start with a short duration.
Protect later connections
Strict-Transport-Security is a header received over valid HTTPS. The browser stores the rule for max-age seconds and then upgrades HTTP visits to HTTPS. It no longer allows bypassing certificate errors for that host.
Without a stored rule or preloading, the first HTTP visit remains exposed. An HTTP-to-HTTPS redirect is still needed. HSTS cannot fix an invalid certificate, application vulnerability or content security.
Check HTTPS coverage
Use hosts you administer. Check certificates, renewal, redirects and HTTPS resources on main pages, error pages and auxiliary services. Inventory subdomains, including old services and those managed by third parties.
These commands use GET without downloading the body or disabling TLS verification. Read every redirect response and the final response; do not rely on HEAD alone.
curl -sS -D - -o /dev/null http://example.com/
curl -sS -L -D - -o /dev/null https://example.com/
curl -sS -D - -o /dev/null https://app.example.com/Increase max-age in stages
Initial example for a host already working over HTTPS: a 300-second rule, without subdomains or preload. Set it on HTTPS responses at the responsible server or proxy, then verify the header actually received.
Strict-Transport-Security: max-age=300- Test navigation, certificates and renewal during the short phase.
- If the service remains reliable, move for example to 86400 seconds (one day), then increase according to your ability to maintain HTTPS.
- Monitor errors before every increase. A long duration also affects visitors who do not return while you apply a fix.
includeSubDomains and preload: two commitments
includeSubDomains covers every descendant of the host setting the rule, including future subdomains. Add it only after validating HTTPS throughout that scope. A rule received on www.example.com does not automatically protect example.com.
preload is not recommended by default. The token alone does not list a domain: submission and list requirements are necessary, including HTTPS on all subdomains and a max-age of at least one year with includeSubDomains. Removal and propagation through browsers take time.
Prepare a rollback
max-age=0 sent over valid HTTPS removes that host’s dynamic rule when the browser receives it. It does not remove a parent’s inherited rule, subdomains’ own rules or a preloaded entry. Simply removing the header leaves existing stored rules to expire naturally.
Maintain HTTPS during the transition. Visitors blocked by an invalid certificate cannot receive your corrective header.
Check the result with Argos
http.security.hsts checks for a recognised positive max-age and an HTTPS final response. External TLS findings may supplement it. This heuristic cannot prove a suitable duration, subdomain coverage or actual inclusion in the preload list.
After checking your scope, rerun a page audit. Compare the final URL and evidence; one URL measurement cannot validate every host. Read the CSP guide for content-loading rules too.
Official references
References checked on 16 October 2026. Adapt and test the examples within your own scope.
Verify your fix
After your tests, rerun an audit of the same public URL and compare available findings.