HSTS means HTTP Strict Transport Security, and makes browsers force your visitors over https. Why do you need this when you already have redirected your site to SSL? HSTS is meant for situations when users are not actually visiting your site, but a site that is pretending to be your site, and therefore does not have a SSL certificate. This fake site won’t have a redirect to SSL! Let’s say a user is in a public place on wifi and visits your site, domain.com. but a hacker is on the network and is directing the user to a fake site, domain.com. It has the same domain, looks the same, but is setup to steal your password when you login. It doesn’t have an SSL certificate. The user will not suspect anything and will be tricked into entering his password.
Enter HSTS
If you had enabled HSTS on your site however, and this user had visited your site before, the browser would remember it should redirect to https. As the fake site does not have an SSL certificate, the user can’t visit the site and will be safe. Browsers will remember this setting for a year, so reverting back to http is difficult (which is by design of course). If you want to deactivate HSTS for your site, read this article on how to clear it from your browser as well.
HSTS preload list
While HSTS is a good thing, there’s still the possibility that the user has never visited your site before. In this case, the would not know it should redirect to https. To prevent this, the preload list had been created. All sites that are accepted onto this list get preloaded in the browsers that support this. If a user opens your site in his browser, the browser already knows it has to request it over SSL and will not allow a connection over http.
When this setting is enabled, you can submit your site to the preload list by clicking the “submit site” button.
But take care! Do not submit your site without knowing exactly what the consequences are.
- Removing is difficult so only add it if you plan to stay on SSL
- All subdomains will be forced over SSL as well. Even if they are on a different server. They’re in the preload list now!
Often occurring issues
- includeSubDomains not included
If you see the notice on hstspreload.org that subdomains are not included in the header, please check if you have enabled the HSTS preload option in settings/ssl/settings. - HTTPS redirect bypasses either www or non-www domain.
If you have this issue, in the case of the primary domain on www, please remove the redirect that redirects directly from http:// to https://www, and make sure it can follow the redirect chain http:// => https:// => https://www - Double HSTS header on domain
Possibly there’s a custom HSTS header in your .htaccess, or your hosting company has enabled HSTS as well. Please remove or deactivate the other HSTS header to resolve the issue.
