Http

If you’ve ever copied this header without thinking too hard about it, you’re not alone: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload It shows up in blog posts, server templates, security scanners, and “best practices” snippets. Then six months later someone realizes staging is broken, a subdomain can’t be reached, or the preload submission was a terrible idea. The biggest source of confusion is max-age. People treat it like a vague “security on/off” switch. It’s not. It’s a cache lifetime, and getting it wrong can lock users into behavior you didn’t mean to enforce. ...

HSTS report-only mode sounds like something browsers should support. They don’t. That’s the first thing worth clearing up, because a lot of developers go looking for a Strict-Transport-Security-Report-Only header and assume they just haven’t found the right syntax yet. There is no standardized HSTS report-only header implemented by browsers in the way Content-Security-Policy-Report-Only works. So if you’re trying to safely “test” HSTS before enforcing it, the real answer is a mix of: ...