Website security

The padlock is not enough: enforce HTTPS with HSTS

Published on 22 October 2026 · David Serreau

Your site shows the padlock: it has a certificate. Yet the browser is not always required to use it. That is exactly what the probe found on this very site, before the fix.

The problem

When someone types your address without “https://”, or clicks an old “http://” link, the first request goes out unencrypted. Your server then redirects to the secure version, but that first request can be read or hijacked on an untrusted network (public Wi-Fi, for example).

The fix: one header line

The Strict-Transport-Security (HSTS) header tells the browser: “for this domain, HTTPS only, for this long”. From then on, the browser itself upgrades any HTTP attempt to HTTPS, and visitors can no longer click through a certificate error.

Strict-Transport-Security: max-age=31536000; includeSubDomains

• max-age: how many seconds the browser remembers the rule (here, one year).
• includeSubDomains: the rule also covers subdomains. Only add it if all your subdomains work over HTTPS.
• preload (optional): asks to be listed in a list built into browsers. Requires at least one year and includeSubDomains. Hard to undo: keep it for stable sites.

The pitfalls

• The header only counts over HTTPS; sent over HTTP, it is ignored.
• The very first visit stays exposed until the browser knows the rule (which is what preload addresses).
• Start with a short duration (one week) if you are unsure about your subdomains, then extend it.

Where to set it

Depending on hosting: a _headers file (Cloudflare Pages, Netlify), an .htaccess file (Apache), the server configuration, or an option in your host's dashboard.

On this site

Before: header missing, the only “to harden” point found. After adding it, the same probe run again shows 0 points to harden. Both reports are on the home page.

Sources

checked on 22 October 2026

• MDN Web Docs, Strict-Transport-Security