SiteCheck

Guides · Security

How to make browsers always use HTTPS

Your site works on HTTPS, but browsers have not been told to always use it. When someone types your address without https://, the browser may try plain HTTP first. Your server then redirects it to the secure address.

A short setting called HSTS removes that first step. The name stands for HTTP Strict Transport Security.

What it does

HSTS is a header your server sends with each HTTPS page. It tells the browser to use only HTTPS for your site for a set time. That time is called max-age, and it is written in seconds.

The browser remembers the rule and changes http:// to https:// before it sends anything. It needs to see the header once, so a very first visit may still start on HTTP. Browsers ignore this header on plain HTTP responses.

Requests with and without HSTSWithout HSTS, the browser asks for the HTTP address, gets a redirect, then asks for the HTTPS address. With HSTS, it goes straight to the HTTPS address on later visits. Browser Server Without HSTS http://example.com (not encrypted) Redirect to https:// https://example.com (encrypted) The page With HSTS, on later visits The browser switches to https:// by itself https://example.com (encrypted) The page
HSTS removes the unencrypted request and the redirect from later visits.

What to check first

Browsers keep the rule until max-age runs out, so check these points before you start.

The includeSubDomains setting extends the rule to every subdomain, such as shop.example.com or mail.example.com. Before you add it, list your subdomains and open each one on HTTPS. A subdomain that only works on HTTP will not open in a browser that has this rule.

How to turn it on

  1. Send the header with a five-minute limit: Strict-Transport-Security: max-age=300
  2. Use your site for a day and look for problems.
  3. Raise it to one week: max-age=604800
  4. After a week with no problems, raise it to 30 days: max-age=2592000
  5. When every subdomain works on HTTPS, use a long-term value: max-age=63072000; includeSubDomains

That last value is two years. If you need to back out, send max-age=0 over HTTPS, and browsers that receive it will forget the rule.

You may also read about a preload list. It is a separate, optional step, and removal from it is slow, so you can leave it out.

Who can set it

On WordPress, the header usually comes from your host or CDN, and some security plugins can add it. SEO plugins such as Yoast and Rank Math do not set it.

Shopify and Wix control the headers on their own servers. They may send HSTS already, and you often cannot change its value. Squarespace has an HSTS Secure option in its SSL panel. If your report still flags it, ask their support.

A developer or host can act on this: "Please add the Strict-Transport-Security header to all HTTPS responses, starting at max-age=300." On a server they control, it looks like one of these:

nginx:  add_header Strict-Transport-Security "max-age=300" always;
Apache: Header always set Strict-Transport-Security "max-age=300"

How to check

Our scan checks that the header is present, so the finding clears even at the five-minute value. Keep raising it after that. Rescan once the header is live.

Check a page

More security guides