HTTP headers
Strict-Transport-Security HTTP Header Meaning
Strict-Transport-Security tells browsers to use HTTPS for this host in the future.
Meaning
The site is asking browsers to remember that HTTP should be upgraded to HTTPS.
Where it appears
HTTPS responses send it after the site is ready for HTTPS-only access.
What to check
Check max-age, subdomain coverage, preload readiness, and whether every subdomain can serve HTTPS.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomainsCommon values and directives
max-agemax-age=<seconds>Browsers remember HTTPS-only behavior for this many seconds.includeSubDomains- The rule also applies to subdomains.
preload- Signals intent to join browser preload lists, but preload submission has separate requirements.