SAGERANK
SAGERANK AI Search Visibility & Security
language العربية Contact Sign Up Free bolt

Domain security

What is HSTS and how do I enable it?

Reviewed 2 November 2026 by the SageRank team

Short answer

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to load your site only over HTTPS for a set time, even if someone types http. It stops downgrade and cookie-stealing attacks on the first redirect. Roll it out with a short max-age first, then raise it to a year.

The header

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  • max-age is how many seconds browsers remember the rule. 31536000 is one year.
  • includeSubDomains applies it to every subdomain.
  • preload signals that you want to be on browsers’ built-in HTTPS list.

Roll it out safely

  1. Make sure HTTPS works on your domain and every subdomain, with valid certificates.
  2. Start with a short value such as max-age=300, then raise it to a day, a week, a month and a year as you confirm nothing breaks.
  3. Add includeSubDomains only when every subdomain really serves HTTPS.
  4. Consider preloading last. Preload requires a max-age of at least one year, includeSubDomains and the preload token. It is slow to undo, so be sure first.

What to know

  • Browsers only honour the header over HTTPS.
  • It applies after the first visit. Preloading covers that first visit.
  • A broken certificate on an HSTS site cannot be clicked through, so monitor expiry.

How SageRank helps

The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.

Related answers