DevUtilsNow
Browse tools
// http header · security header

Strict-Transport-Security

Force HTTPS for future requests (HSTS)

What the Strict-Transport-Security header does

Strict-Transport-Security (HSTS) tells the browser to only ever connect over HTTPS for the given duration, even if a user types http://. includeSubDomains extends it to subdomains. It defends against protocol-downgrade and cookie-hijacking attacks.

Example

max-age=63072000; includeSubDomains

Where it's used

Strict-Transport-Security is a security header. Security headers tell the browser to turn on protections against common web attacks.

Other security headers

Strict-Transport-Security Content-Security-Policy X-Content-Type-Options X-Frame-Options Referrer-Policy Permissions-Policy
TOOL

HTTP Headers Parser

Turn a block of raw headers into readable JSON.

REFERENCE

All HTTP Headers

Common request, response, caching, CORS, and security headers.

GUIDE

How to Read and Parse HTTP Headers

The anatomy of headers and how to work with them.