HSTS Header Builder

Turns a small set of toggles into the Strict-Transport-Security header that tells every browser to stick to HTTPS on your domain. Includes three presets — a 5-minute rollout window for new policies, a sane 1-year production setting with includeSubDomains, and the 2-year+ configuration that the HSTS preload list requires. The eligibility block lights up when your settings match Chromium's preload submission requirements so you know it's safe to apply.

HSTS is remembered by the browser, which is what makes max-age a commitment rather than a setting. Once a visitor has seen the header, that browser refuses plain HTTP for your host until the timer runs out, and you cannot reach back and shorten it. Serving max-age=31536000 means a year of enforced HTTPS for everyone who visited today, even if you change your mind tomorrow. The five-minute preset exists so a new policy can be tried without that consequence, and the way to retract one is to serve max-age=0 long enough for every affected browser to see it.

The header is ignored over plain HTTP by design, so it protects the second visit rather than the first. A user who types the bare hostname still makes one cleartext request before the redirect teaches their browser the rule, and that request is the one an attacker on the network wants. Preloading is the answer to exactly that gap: browsers ship the list, so the very first request goes to HTTPS.

includeSubDomains reaches names you may not be thinking about. It covers every subdomain, including internal tooling, a legacy box that has no certificate, and hosts created after the header went out. Anything under the domain that cannot serve HTTPS becomes unreachable in that browser for the life of the timer.

Preloading is much harder to undo than to do. Removal is a manual request and then a wait for browser releases to carry it, measured in months, so submit a domain only when every current and future subdomain will serve HTTPS.