What is HSTS? HTTP Strict-Transport-Security explained
HSTS is a response header that says “from now on, only talk to me over HTTPS.” Browsers remember that policy and refuse cleartext HTTP—even if someone tries a downgrade.
What the Strict-Transport-Security header does
When a browser sees Strict-Transport-Security on an HTTPS response, it stores a policy for that host. For the next max-age seconds it will upgrade http:// links to https:// and block certificate-error overrides that would otherwise let users click through. That cuts simple SSL-stripping and accidental mixed HTTP bookmarks.
What CrowWake checks
On HTTPS we look for a Strict-Transport-Security header. Missing HSTS → warn. Present → we summarize the value (max-age and flags) so you notice accidental deletes after a CDN or origin change. The free security headers checker uses the same signal with no login—CrowWake’s hourly flock watches it afterward.
max-age, includeSubDomains, and preload
max-age is how long (in seconds) browsers keep the policy—common starts are a day or a week while you test, then months once HTTPS is solid. includeSubDomains applies the policy to every subdomain (powerful; only use when all subdomains are HTTPS-ready). preload is a signal for the browser preload list—do not add it until you understand the long-lived commitment and have submitted via the official HSTS preload process.
When to turn HSTS on
Only after HTTPS works cleanly on every hostname users hit (apex and www if both are live), redirects from HTTP are correct, and certificates renew reliably. Turning on HSTS while HTTP still serves a different site—or while staging hosts share a parent domain—locks browsers into pain. Pair HSTS with a working TLS cert; an expired cert plus HSTS is a harder outage than either alone.
Quick publish triage
1) Confirm HTTPS and HTTP→HTTPS with the free security headers checker. 2) Confirm SSL expiry runway. 3) Add Strict-Transport-Security at the CDN or origin with a modest max-age first (for example 86400). 4) Re-check the header value, then raise max-age once stable. 5) Add includeSubDomains only when every subdomain is ready. 6) Add the domain so CrowWake crows if HSTS disappears after a rebuild.
If CrowWake crows
Missing HSTS → publish the header once HTTPS is trustworthy. Present then gone → restore at the CDN/origin (common after “simplify headers” deploys). Users stuck on HTTPS errors after a bad cert → fix TLS first; HSTS is doing its job by refusing insecure fallback. After a fix, re-run the free security headers checker and keep watching.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free security headers checker with no login.
Deep dive: Security headers monitoring — watch HSTS with nosniff, framing, and HTTPS redirect on the same free checker.
Related: HTTP→HTTPS redirect (fix first), X-Frame-Options / clickjacking, X-Content-Type-Options / nosniff, the security headers & open ports guide, and the free SSL expiry checker (HSTS needs a healthy cert).