What is HTTP Strict Transport Security (HSTS)?

When a web browser receives an HSTS policy from a website, it will only communicate with the website through a secure HTTPS connection and will automatically reject any attempt to communicate over an insecure HTTP connection.

The main benefits of using HSTS are increased security for website visitors and improved website performance by eliminating the need for extra redirects from HTTP to HTTPS.

You can check if your website has HSTS enabled by using online tools such as a HTTP Header Checker or by checking the browser's security information for the website.

You can enable HSTS on your website by adding a header to the HTTP response that your server sends to web browsers. The header in your .htaccess file should include the "Strict-Transport-Security" field and specify the maximum age of the policy.

Example:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

Header onsuccess unset Strict-Transport-Security

• max-age specifies the time in seconds that the browser should remember the HSTS policy for this site. In this example, it's set to 31536000 seconds, which is equivalent to one year.
• includeSubDomains applies the HSTS policy to all subdomains of the domain specified in the Host header.
• preload indicates that the website owner has submitted their domain to the HSTS Preload List, as described on https://hstspreload.org/.

Yes, you can preload HSTS for your website by submitting it to the HSTS preload list maintained by Chrome and also used bij Firefox, Safari and Edge. Once preloaded, web browsers will automatically enforce HSTS for your website without the need for an initial HTTPS connection.

To be eligible for preloading, your website must meet the following criteria:

• Have a valid HTTPS (SSL) certificate.
• Redirect all HTTP traffic to HTTPS.
• Serve all subdomains over HTTPS.
• Have a maximum age of at least 1 year (31536000 seconds) in the Strict-Transport-Security header.

You can check your website's eligibility for preloading on the HSTS preload list website.

You can submit your website to the HSTS preload list by using the submission form available at https://hstspreload.org/.

It is recommended to renew your HSTS policy every year to ensure maximum security for your website visitors.

By implementing HTTP Strict Transport Security (HSTS), you can improve the security and performance of your website for your visitors.