HSTS (Strict-Transport-Security)
What are HSTS?
HSTS (HTTP Strict Transport Security) is a security policy a site sends with the `Strict-Transport-Security` response header. It tells browsers to connect only over HTTPS for a set period: if a visitor types http:// or follows an old HTTP link, the browser switches to HTTPS itself before sending any request.
The header has three parts. `max-age` is how long, in seconds, the browser should remember the rule. `includeSubDomains` applies it to every subdomain. `preload` signals that you want the domain on the HSTS preload list built into Chrome, Firefox, Safari and Edge, which protects even a visitor’s very first visit. Browsers only honour the header when it arrives over HTTPS.
Why HSTS matter for SEO
A 301 from HTTP to HTTPS still leaves the first request unencrypted, which an attacker on the same network can intercept. HSTS closes that gap, and it also removes the redirect hop for returning visitors, so pages start loading slightly sooner.
HSTS is not a Google ranking factor. It is a security best practice that completes a move to HTTPS, and it is one of the security headers audits check for.
It is also hard to undo. Browsers remember it for the full max-age, and removal from the preload list can take months to reach users. If any subdomain still needs HTTP, `includeSubDomains` will break it.
How to enable HSTS
- Make sure every page and every subdomain you plan to cover works over HTTPS, and that HTTP redirects to HTTPS.
- Start with a short max-age, such as `max-age=300` (five minutes), and check nothing breaks.
- Raise it in steps to a week, a month, then a year (`max-age=31536000`).
- Add `includeSubDomains` once you are sure no subdomain needs HTTP.
- Only then consider preloading at hstspreload.org. It requires a max-age of at least one year, `includeSubDomains` and `preload`, served on the bare domain over HTTPS.
HSTS example
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadHSTS FAQ
Is HSTS required for SEO?
No. Google does not use it as a ranking signal. It is a security measure that makes sure visitors always reach the HTTPS version of your site.
What max-age should I use for HSTS?
Work up to one year (31536000 seconds), which is also the minimum for the preload list. Start with a few minutes so you can roll back quickly if something breaks.
Related SEO terms
HTTPS is the encrypted version of HTTP. It protects data between browser and site, and Google uses it as a lightweight ranking signal.
Security headers are HTTP response headers that tell browsers how to handle a site’s content safely, blocking common attacks.
Mixed content is when an HTTPS page loads images, scripts or other files over insecure HTTP. Browsers block or upgrade much of it.
A 301 redirect permanently sends visitors and search engines from one URL to another and tells Google the new URL should be indexed.
Technical SEO is making sure search engines can crawl, render and index your site, covering speed, redirects, canonicals, sitemaps and mobile.