Consider submitting the domain to the HSTS preload list

Why it matters

HSTS protects visitors only after their first secure visit, while the preload list covers the very first one as well. It is optional and hard to undo, so only do it when you are sure about HTTPS on the whole domain.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Treat this as optional. Skip it if you cannot guarantee HTTPS on every subdomain for the long term, including internal, staging and legacy ones.
2. Have HSTS running with max-age of one year (31536000) and includeSubDomains for a while without problems first.
3. Add the preload directive to the header, check the domain at hstspreload.org and fix anything it reports. Then submit it only when you are sure.
4. Removal takes months to reach users through browser updates, so there is no quick rollback.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload