What is HSTS Preload?
How to Enable Maximum HTTPS Security

If you already have an SSL certificate installed and HTTP-to-HTTPS redirects in place, that is a strong foundation. But there is still one vulnerability: the very first HTTP request before the redirect happens. Attackers can exploit this window with SSL Strip or Man-in-the-Middle attacks.

HSTS Preload closes this gap entirely. This guide explains what it is, how it works, and how to get your domain added to the list that browsers worldwide use.

What is HSTS — The Basics

HTTP Strict Transport Security (HSTS) is a web server policy that tells browsers "this website uses HTTPS only" via the Strict-Transport-Security response header.

Once a browser receives this header, it remembers for the specified duration (max-age) that the domain requires HTTPS. Before sending any request, the browser automatically upgrades http:// to https:// without contacting the server.

What Does HSTS Protect Against?

• SSL Strip Attacks — attackers downgrade connections from HTTPS to HTTP
• Man-in-the-Middle (MitM) — interception between user and server on insecure networks
• Cookie Hijacking — capturing cookies transmitted over HTTP
• Passive Eavesdropping — monitoring unencrypted traffic

What is HSTS Preload and How it Differs

Despite HSTS being excellent, it has one weakness called Trust On First Use (TOFU): the browser must visit the site over HTTPS at least once before it remembers to enforce HTTPS.

If the first visit happens over HTTP — such as typing a bare domain name or clicking an http:// link — the user is still at risk during that initial connection.

HSTS Preload solves this by embedding a list of HTTPS-only domains directly into browsers. No first visit required — browsers already know these domains require HTTPS before they are even installed.

How HSTS Preload Works

Chrome maintains the HSTS Preload List as an open-source project that all major browsers use. This list is embedded in browser source code as a file named transport_security_state_static.json.

1. Website owners submit their domain at hstspreload.org
2. The Chrome team verifies requirements (SSL + headers + subdomains)
3. The domain is added to the list and merged into Chromium source
4. When a new Chrome release ships, the updated list is distributed worldwide
5. Firefox, Safari, and Edge pull the same list and use it

Requirements Before Submitting

hstspreload.org requires you to pass all 5 conditions before submission:

1. Valid SSL certificate — not expired, issued by a trusted CA
2. HTTP → HTTPS redirect — port 80 must redirect to HTTPS in all cases
3. HTTPS must serve on port 443 directly
4. HSTS header on HTTPS must include:
   • max-age ≥ 31,536,000 (1 year)
   • includeSubDomains
   • preload
5. All subdomains must support HTTPS — e.g., www, mail, ftp must have SSL certificates

Step-by-Step Submission Guide

Step 1 — Install an SSL Certificate

You need a valid SSL certificate on your main domain and all subdomains. Use Let's Encrypt (free) or a commercial certificate from a trusted CA.

Step 2 — Configure HTTP → HTTPS Redirect

On DirectAdmin hosting, add this to your .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Step 3 — Add the HSTS Header

# In .htaccess after the redirect block
Header always set Strict-Transport-Security \
  "max-age=31536000; includeSubDomains; preload"

Step 4 — Test at hstspreload.org

Open hstspreload.org, enter your domain, and click Check Eligibility. All requirements must pass before submitting.

Step 5 — Submit Your Domain

Click Submit on hstspreload.org and enter your email to receive status notifications.

Step 6 — Wait for Review

The Chrome team will review and merge into the list — typically 4-8 weeks before most users receive the update in a new Chrome release.

Complete .htaccess HSTS Configuration

Full Apache configuration for DirectAdmin hosting:

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# HSTS Header (add preload when ready to submit)
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security \
    "max-age=31536000; includeSubDomains; preload"
</IfModule>

Comparing HTTPS Security Levels

Pros and Considerations

Advantages

• Protects the very first visit — no TOFU vulnerability
• Completely prevents SSL Strip Attacks
• Increases website trustworthiness
• Aligns with Google security best practices
• Passes high-level security audits
• Free to submit

Considerations

• Very difficult to remove — effects persist for over a year
• Every subdomain must have SSL — any subdomain without SSL becomes inaccessible
• SSL must never expire — expired SSL locks out all users
• Development/staging environments need SSL too — if using the same domain

How to Remove Your Domain from the Preload List

To remove your domain, go to hstspreload.org/removal and:

1. Remove the preload directive from your HSTS header on the server
2. Submit a removal request at hstspreload.org/removal
3. Wait for Chrome to release a new version that excludes your domain from the list

Frequently Asked Questions