HSTS Header Builder
Turns a small set of toggles into the Strict-Transport-Security header that tells every browser to stick to HTTPS on your domain. Includes three presets — a 5-minute rollout window for new policies, a sane 1-year production setting with includeSubDomains, and the 2-year+ configuration that the HSTS preload list requires. The eligibility block lights up when your settings match Chromium's preload submission requirements so you know it's safe to apply.
Strict-Transport-Security: max-age=31536000; includeSubDomains- ✓max-age ≥ 31536000 (1 year)
- ✓includeSubDomains is on
- ×preload directive is on
Apply this on every HTTPS response. Only the eldest matching policy a browser has seen is the one it enforces.
How to use
- Start with the rollout preset (5 min) when first turning HSTS on — it's easy to back out if something breaks.
- Once stable, jump to the production preset (1 year + includeSubDomains).
- Only enable preload when you've confirmed every subdomain works on HTTPS forever — preload removal takes months.
Frequently asked questions
- What does max-age actually do?
- It tells the browser to remember "this domain is HTTPS-only" for that many seconds. While the memory holds, the browser refuses any plain-http navigation to the domain and upgrades it to https before sending.
- Is preload reversible?
- Slowly. Submitting to the Chromium preload list is easy; removal requires a separate request and can take months to propagate to all browser releases. Don't enable preload until you're sure every subdomain works on HTTPS.
Related tools
Content-Security-Policy Builder
Build a CSP header from per-directive source lists, with three starter presets and live warnings for the dangerous wildcards.
Referrer-Policy Header Builder
Pick a Referrer-Policy value and see exactly what `Referer` header outbound requests will send — same-origin, cross-origin HTTPS, HTTPS→HTTP downgrade.
Cache-Control Header Builder
Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.
Cookie / Set-Cookie Header Builder
Compose a `Set-Cookie` response header from name/value plus the security attributes — SameSite, Secure, HttpOnly, Partitioned, Max-Age — with safety warnings.
Permissions-Policy Header Builder
Build the `Permissions-Policy` response header — toggle camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.
CSP Hash Generator
Compute the sha256 / sha384 / sha512 base64 hash an inline <script> or <style> block needs to be whitelisted by a Content-Security-Policy.