Table of Contents

About

Strict Transport Security (HSTS) 1) is a header that tells the client that the website should always be contacted with HTTPS

Effect

When HSTS is on, if it's not possible to make a https connection (for instance if the certificate is not valid), the user will not be able to navigate the website and will get this message.

Hsts Chrome Message

Management

Set

Recommended value: 

Strict-Transport-Security: max-age=31536000; includeSubDomains

Example in Apache The Apache htaccess file with Apache - HTTP Header (mod_header module) 

Header set Strict-Transport-Security "max-age=63072000; includeSubDomains"

Hardcoded in chrome (preload)

To submit domains for hard coded inclusion in Chrome's HTTP Strict Transport Security (HSTS) preload list:

  • Add the preload tag to the value
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Delete

In chrome 

chrome://net-internals/#hsts
  • type your domain (ie you messed up with localhost enter localhost)
  • then delete

Hsts Delete Chrome 2)

1)
RFC 6797 HTTP Strict Transport Security (HSTS)
2)
Strict-Transport-Security