Implement HTTP Strict Transport Security (HSTS)

Introduction

HSTS is a header that forces the browser to always use HTTPS for a domain, for a defined duration — even if the user types http:// or clicks an old unencrypted link.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

The problem it solves: downgrade / SSL-stripping

Even if a site only ever serves HTTPS, there’s still a gap: the very first request. If a user types example.com without https://, or clicks an old http:// link, the browser sends that first request unencrypted — before the server gets a chance to redirect it to HTTPS.

On a shared network (public wifi, a compromised router), an attacker can intercept that first HTTP request and read or redirect it before the HTTPS redirect ever happens. This is a downgrade attack (SSL-stripping): the attacker keeps the conversation on unprotected HTTP while the user believes they’re safe.

HSTS closes this gap: the first time the browser visits the site over HTTPS, it remembers this header for max-age seconds. After that, it rewrites http:// to https:// locally, before sending anything on the network — so there is nothing left to intercept.

The 3 directives

How to add it

Unlike CSP, HSTS’s value never changes between requests — no nonce, nothing dynamic. next.config.js’s headers() is enough; no middleware.ts needed.

// next.config.js
const nextConfig = {
  async headers() {
    return [
      {
        source: "/(.*)", // apply to all routes
        headers: [
          {
            key: "Strict-Transport-Security",
            value: "max-age=63072000; includeSubDomains; preload",
          },
        ],
      },
    ];
  },
};

Some apps gate it behind process.env.NODE_ENV === "production" — reasonable, since forcing HTTPS on localhost during local dev gets in the way.

How to verify: DevTools → Network tab → select the document request → Response Headers → look for Strict-Transport-Security.

Rollout status (September 2026 audit)