HSTS Header Generator
Generate HTTP Strict-Transport-Security (HSTS) headers with max-age, includeSubDomains, and preload directives, check HSTS preload list requirements, and copy
Loading tool...
What is HSTS Header Generator?
A Strict-Transport-Security (HSTS) header generator for enforcing HTTPS in the browser. Pick a max-age window from quick presets, add includeSubDomains and preload directives, verify the result against HSTS preload list requirements, and copy the finished header along with nginx, Apache, and Express.js deployment snippets.
Key Benefits
- Force repeat visitors onto HTTPS and neutralize SSL-stripping attacks
- Ramp up safely: short max-age while testing, years in production
- Instant feedback on HSTS preload eligibility before you submit anything
- Correct directive syntax and ordering without manual typos
- Matching server snippets for nginx, Apache, and Express.js
Common Use Cases
- •Harden a production site after confirming every subdomain supports HTTPS
- •Test an HSTS rollout on staging with a short 5-minute max-age
- •Prepare a domain for submission to the official hstspreload.org list
- •Add the header flagged as missing by a security scanner or pentest report
How to Use the HSTS Header Generator
- Choose a max-age value: Enter the number of seconds browsers should enforce HTTPS, or pick a preset. Start with a short window such as 5 minutes while testing, then move to one or two years once you are confident every subdomain serves valid HTTPS.
- Set the directives: Enable includeSubDomains to cover every subdomain of your host. Enable preload only when you plan to submit the domain to the official HSTS preload list built into Chrome, Firefox, and Edge.
- Check preload requirements: If preload is enabled, review the checklist: max-age must be at least one year, includeSubDomains must be set, and you should understand that removal from the preload list can take months.
- Copy and deploy the header: Copy the generated Strict-Transport-Security header, or grab the ready-made nginx add_header, Apache Header always set, or Express.js middleware snippet and deploy it so the header ships on every HTTPS response.
Key Features
- Live Strict-Transport-Security header built from max-age, includeSubDomains, and preload options.
- Six max-age presets ranging from a 5-minute testing window to two-year production values.
- Preload readiness checklist validating the one-year max-age and includeSubDomains requirements.
- Copy-ready outputs for the raw header plus nginx add_header, Apache Header always set, and Express.js middleware.
- Bilingual EN/TH interface, fully offline, nothing leaves your browser.
Frequently Asked Questions
What does the Strict-Transport-Security (HSTS) header do?
It tells the browser that your site must only be reached over HTTPS for the duration of max-age, including future visits. After the first secure connection, the browser upgrades or refuses insecure http:// requests automatically, which prevents SSL-stripping man-in-the-middle attacks.
What does includeSubDomains do?
Without it, the HSTS policy applies only to the exact host that sent the header. With includeSubDomains, every subdomain such as api.example.com or mail.example.com is forced onto HTTPS too. Only enable it when you are certain every subdomain serves valid HTTPS certificates.
Should I enable preload?
Only if you intend to submit your domain to the hstspreload.org list that ships built into major browsers. Preload requires a max-age of at least one year and the includeSubDomains directive. Getting off the list later can take months, so treat it as a long-term commitment.
Where do I put the generated header?
Send it as an HTTP response header from your web server, reverse proxy, or CDN. Use the provided snippets: nginx add_header, Apache Header always set, or Express.js res.setHeader middleware, so the header is attached to every HTTPS response.