Strict-Transport-Security

Tells browsers to use only HTTPS for this site for a set time (HSTS).

Header name, or pasted headers

Explained

Examples

Example

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

It is ignored over plain HTTP. With includeSubDomains, every subdomain must work over HTTPS before you turn it on.

Defined in RFC 6797.