HSTS: when to turn it on

Turn HSTS on only after HTTPS already works cleanly on your site. The header tells browsers to skip HTTP on the next visit and remember that choice for the max-age window you set. If you still need plain HTTP for a migration, a leftover tool, or a hostname that is not ready, leave HSTS off until those problems are gone.

What the header actually does

HSTS is a response header your server sends over HTTPS. Browsers that see it will refuse HTTP for that hostname until max-age expires. That is helpful once certificates, redirects, and mixed content are stable. It is painful when you might still need HTTP next week, because users cannot click through to an insecure page the way they can with a normal certificate warning.

You can check what you already send with a simple request:

curl -sI https://example.com | grep -i strict-transport

An empty result means HSTS is off. A long max-age with includeSubDomains and preload is a strong commitment, so only keep those flags if you truly intend them.

Header on your server versus browser preload

The header lives on your hosting account, so you can lower max-age, remove flags, or turn it off and wait for old values to expire. Preload is different. Submitting a name puts it in lists that major browsers ship in their binaries, and removal is slow. Do not submit preload during a move, and do not start with a year-long max-age on day one.

Begin with a short max-age measured in minutes or hours. After phones and desktops keep loading the site without trouble, raise it to a day, then a week, then months. Treat includeSubDomains as a wider promise. It forces HTTPS for mail, staging, and any forgotten subdomain, so inventory those names first.

When you should leave HSTS off

Skip HSTS while you are mid-migration or while AutoSSL has not finished on the new host. Leave it off if an HTTP-only hostname still matters, such as a legacy endpoint or a monitoring check you have not updated. Fix long redirect chains and Android certificate failures before you add the header. Make HTTPS dull and reliable, then enable HSTS with a small max-age and no preload.

For almost every site we host, the safe default is HTTPS on apex and www, one clean 301, then HSTS with a modest max-age and no preload. Preload can wait until much later, after nothing about HTTPS surprises you anymore.