Welcome to HSTS Guide

If you run a Phoenix app over HTTPS and you are not sending HSTS yet, you are leaving a pretty basic downgrade attack on the table. HSTS tells the browser: “Stop trying plain HTTP for this site. Use HTTPS only for a while.” That blocks SSL stripping and a bunch of accidental insecure requests after the first secure visit. Phoenix makes this easy, but there are a few sharp edges: ...

HTTP Strict Transport Security is one of those headers that’s simple, powerful, and easy to get subtly wrong. If you’re serving a Rust app with Actix-web, HSTS usually comes down to one header: Strict-Transport-Security: max-age=31536000; includeSubDomains That header tells browsers: “For this domain, always use HTTPS for the next year.” Once a browser sees it over a valid HTTPS connection, it will refuse to use plain HTTP for that site until the policy expires. ...

If you run Envoy at the edge, HSTS is one of those headers you should set deliberately instead of “getting around to it later”. It is simple on paper: tell browsers to always use HTTPS for your site. In practice, the question is where to inject it in an Envoy-based stack, and that choice affects operability, consistency, and the blast radius of mistakes. For Envoy, there are a few common approaches: ...

HTTP Strict Transport Security is one of those headers you set once, then hopefully never think about again. That’s also why people get it wrong. For Express apps, HSTS looks deceptively simple: add a header and move on. But the real-world version has edge cases around reverse proxies, local development, subdomains, preload, and rollbacks. If you set preload too early, you can create a painful cleanup project for yourself. Here’s the practical guide I wish more teams followed. ...

HSTS looks simple until you have more than one environment. On paper, it’s one header: Strict-Transport-Security: max-age=31536000; includeSubDomains In real teams, that header touches local development, preview deployments, staging subdomains, internal tools, CDNs, load balancers, and production rollback plans. That’s where people get burned. I’ve seen teams enable HSTS in production, break staging, lock developers out of test hosts, and then discover they can’t “just turn it off” because browsers cached the policy exactly like they were supposed to. ...

If you’re serving a Fiber app over HTTPS and you haven’t set HSTS yet, you’re leaving a pretty obvious gap in transport security. HSTS tells the browser: “stop trying plain HTTP for this site, always use HTTPS.” That blocks protocol downgrade attacks, strips out a whole class of SSL-stripping nonsense, and reduces accidental insecure requests from users who type example.com instead of https://example.com. For Go developers, the good news is that HSTS is just a response header. The bad news is that it’s also one of those headers that can lock users into a bad config if you ship it carelessly. ...

If you run GraphQL Yoga in production without HSTS, you’re trusting every first insecure hop a browser might take before it reaches your HTTPS endpoint. That’s a bad bet. HSTS, or HTTP Strict Transport Security, tells browsers: “stop trying plain HTTP for this site; use HTTPS only.” For a GraphQL API, that matters more than people think. GraphQL often carries auth tokens, session cookies, admin operations, and introspection data you really don’t want exposed over downgraded or intercepted connections. ...

If you’ve ever copied this header without thinking too hard about it, you’re not alone: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload It shows up in blog posts, server templates, security scanners, and “best practices” snippets. Then six months later someone realizes staging is broken, a subdomain can’t be reached, or the preload submission was a terrible idea. The biggest source of confusion is max-age. People treat it like a vague “security on/off” switch. It’s not. It’s a cache lifetime, and getting it wrong can lock users into behavior you didn’t mean to enforce. ...

HTTP Strict Transport Security, or HSTS, is one of those security headers that feels deceptively simple. Set one response header, ship it, done. Except that’s not really how it works in production. If you run a Django app and want HSTS configured properly, you need to understand what it actually does, how Django exposes it, and how to roll it out without accidentally breaking local development, subdomains, or a half-migrated environment. ...

If you use WebSockets in a browser app, HSTS absolutely matters. A lot of teams set Strict-Transport-Security for normal page loads and APIs, then forget that their frontend also opens ws:// or wss:// connections. That gap creates weird mixed transport behavior at best and a downgrade risk at worst. The short version: modern browsers generally apply HSTS to WebSocket connections too. If a host is known to be HSTS, a ws:// URL to that host is treated like wss:// before the network request goes out. That’s good news, but there are edge cases and deployment mistakes that still break things. ...