HSTS without locking yourself out of HTTP forever

What the header actually does

HSTS tells browsers: for max-age seconds, never speak HTTP to this host. The first visit can still be HTTP unless the site is on the preload list. After that, SSL-stripping on cafe Wi-Fi gets much harder. SiteRune scores presence of Strict-Transport-Security on the final URL. We do not invent preload.

A safe rollout

Start with max-age=86400 (a day) on production HTTPS. Confirm nothing still needs HTTP: old APIs, staging on a subdomain, email links. Then raise to 31536000 and add includeSubDomains only if every subdomain is on TLS. Preload last, and only if you understand you are asking Chrome to hard-code HTTPS for your domain.

• WordPress: set it in nginx / the host, not a random plugin that also blocks GPTBot.
• Next.js: headers() in next.config or the Vercel Security Headers UI.
• Shopify / Webflow / Wix: you probably need Cloudflare in front. The admin will not send HSTS.

How SiteRune scores it

Finding id: sec-hsts. High if the page is already HTTPS, medium if it is still HTTP (fix TLS first). Loopback hosts are not failed for HTTP — we are not going to punish localhost. Production SiteRune sends max-age=31536000; includeSubDomains; preload because this origin has no HTTP subdomains we still need.