HSTS Preload Header Generator

The HSTS Preload Header Generator builds a correctly formatted Strict-Transport-Security HTTP response header and tells you, in real time, whether the result qualifies for the browser preload list at hstspreload.org. Set a max-age, toggle includeSubDomains and preload, and copy the header straight into your server configuration.

What is HSTS?

HTTP Strict Transport Security (HSTS), defined in RFC 6797, is a response header that instructs browsers to only ever connect to your site over HTTPS. Once a browser has seen the Strict-Transport-Security header, it refuses plain-HTTP connections to that host for the length of max-age — automatically rewriting http:// requests to https:// before they leave the machine. This blocks protocol-downgrade attacks, SSL-stripping and cookie hijacking over insecure connections.

What is HSTS preloading?

Even with HSTS enabled, a user's very first visit — before any header has been received — can still travel over HTTP, leaving a small window for attack. Preloading closes that gap. Domains on the HSTS preload list are hard-coded into Chrome, Firefox, Safari, Edge and other browsers, so they are treated as HTTPS-only from the first request, with no prior visit required.

How to use the tool

1. Enter a max-age in seconds. The default, 31536000, is one year — the minimum accepted for preloading.
2. Tick includeSubDomains to extend the policy to every subdomain.
3. Tick preload to mark the domain as a preload-list candidate.
4. Copy the generated header from the output box and add it to your web server or application config.

The Preload Eligibility panel checks your directives against the submission rules and flags anything missing.

Directive reference

• max-age=<seconds> — required. How long browsers enforce HTTPS-only for the host.
• includeSubDomains — optional, but required for preloading. Applies the policy to all subdomains.
• preload — signals consent to be added to the browser preload lists.

What are hstspreload.org's requirements?

To be accepted, the header must set max-age to at least 31536000 (one year) and include both includeSubDomains and preload. In addition, the site must serve a valid HTTPS certificate and redirect all HTTP traffic to HTTPS on the same host. The tool verifies the directive requirements; the certificate and redirect requirements must be confirmed on your own server.

Is preloading reversible?

Not easily. Removal requests can take months to propagate through browser releases, and during that time the browser will refuse any HTTP fallback. Only submit a domain for preloading once every subdomain is reliably served over HTTPS.

What max-age should I use?

Start with a short max-age (a few minutes or hours) while testing, so mistakes expire quickly. Once you are confident every resource works over HTTPS, raise it to one year (31536000) or two years (63072000) and add preload.

Does this tool submit my domain?

No. Everything runs in your browser — the tool only builds the header string and checks the directives. Submit the domain yourself at hstspreload.org once your server is ready.