HSTS Header Generator

Generate an HSTS header to enforce HTTPS connections for your website. Free, secure, and works directly in your browser.

Presets

Basic
max-age=31536000; includeSubDomains
Strict
max-age=31536000; includeSubDomains; preload
Development
max-age=300
Testing
max-age=86400

Configuration

Time in seconds that the browser should remember to only use HTTPS

Security Level

High
Your HSTS configuration provides strong security

Generated Header

Strict-Transport-Security: max-age=31536000; includeSubDomains

Server Configuration

Implementation Steps

  1. Ensure your site has a valid SSL/TLS certificate
  2. Test your site with HTTPS to ensure all resources load correctly
  3. Add the HSTS header to your server configuration
  4. Restart your web server to apply changes
  5. Test the header using browser developer tools or online tools
  6. Consider submitting your site to the HSTS preload list if using preload

Testing Tools

Browser Developer Tools
Check the Response Headers in the Network tab
curl Command
curl -I https://yoursite.com
Online Tools
securityheaders.com, ssllabs.com, hstspreload.org

Common Issues

Certificate Errors
Browsers will ignore HSTS if the certificate is invalid
Mixed Content
HTTP resources on HTTPS pages will cause security warnings
Too Long max-age
Start with a shorter max-age during testing

How to use HSTS (HTTP Strict Transport Security) Generator

  1. Enter your desired max-age value for how long the policy should be cached.
  2. Select any additional directives you want to include, like preload or includeSubDomains.
  3. Click the 'Generate' button to create your HSTS header.
  4. Copy the generated header and implement it in your web server configuration.

Features

  • Generates standards-compliant HSTS headers for any max-age duration.
  • Provides options for key directives like includeSubDomains and preload.
  • Outputs the exact header string ready for immediate server implementation.
  • Works instantly with no setup, accessible from any device.

Who Is This Tool For?

This tool is essential for web developers, system administrators, and security professionals who need to implement the HSTS header to enforce HTTPS and protect their websites from downgrade attacks.

Why Generate a Secure HSTS Header?

Implementing a correctly configured HSTS (HTTP Strict Transport Security) header is a critical security best practice that instructs browsers to only connect to your site over HTTPS, preventing protocol downgrade and man-in-the-middle attacks. This ensures long-term security for your users' data and helps build trust.

Frequently Asked Questions

Is this HSTS Generator tool free?

Will my site information be stored or logged?

What does the HSTS header do?

Can I customize the max-age duration for the policy?

Does the generated header include the preload directive?

Related Tools