What is HSTS?
HSTS stands for HTTP Strict Transport Security. It is a response header that tells a browser: for the next stretch of time, only ever contact this domain over HTTPS. After a browser has seen it, a typed or clicked http:// address is rewritten to https:// inside the browser, with no insecure request sent.
It closes the gap a plain HTTP-to-HTTPS redirect leaves open, where the first request still travels unencrypted and can be intercepted.
The header
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
max-ageis how long, in seconds, the browser should remember the rule. 31536000 is one year.includeSubDomainsextends the rule to every subdomain.preloadsignals that you agree to be added to the list built into browsers.
Browsers only accept the header on an HTTPS response. Sent over HTTP it is ignored, because an attacker could inject or strip it there.
The preload list
The header protects returning visitors, not the very first visit. To cover that too, browsers ship with a preload list of domains that are HTTPS-only from the start. You submit a domain at hstspreload.org, which requires a valid certificate, a redirect from HTTP to HTTPS on the same host, all subdomains served over HTTPS, and a header with max-age of at least one year plus both includeSubDomains and preload.
Getting off the list takes months to reach users, since it travels with browser releases. Treat preloading as permanent.
What it means for SEO
HSTS is a security feature, not a ranking factor, but it touches two SEO topics.
The 307 in developer tools. When Chrome upgrades a request because of HSTS, the Network panel shows a 307 Internal Redirect. Your server never sent it. It can look like a temporary redirect where a permanent one belongs, which sends people hunting for a misconfiguration that is not there. See 307 redirect.
You still need the 301. Crawlers and first-time visitors that have no stored HSTS rule rely on the server-side 301 redirect from HTTP to HTTPS. HSTS adds to that redirect. It does not replace it.
Rolling it out safely
The risk is locking browsers into HTTPS for a host that cannot serve it, such as a forgotten subdomain running an old tool. So go in stages:
- Fix all mixed content and confirm every subdomain has a certificate.
- Start with a short lifetime:
max-age=300, withoutincludeSubDomains. - Raise it to a week, then a month, then a year, checking for reports of unreachable hosts in between.
- Add
includeSubDomains, and only then considerpreload.
On WordPress the header is set outside the application: in .htaccess on Apache, in the server block on Nginx, or with a switch at your CDN or host. Verify with curl -I https://example.com and look for the strict-transport-security line.
Common questions
Does HSTS improve rankings?
No. Google uses HTTPS as a minor signal and HSTS does not add to it. Its benefit is security: browsers stop making insecure requests to your domain.
Does HSTS replace the HTTP to HTTPS redirect?
No. The browser only learns the rule from an HTTPS response, so the redirect is still needed for first visits and for crawlers. Preloading also requires the redirect to be in place.
How do I turn HSTS off?
Send the header with max-age=0 over HTTPS, and browsers drop the rule on their next visit. A preloaded domain must also be removed from the preload list, which takes much longer to reach users.