HTTP Strict Transport Security is a policy a site sends in the Strict-Transport-Security response header. Once a browser has seen it, the browser converts every future HTTP request for that domain to HTTPS before sending it, for the period set by max-age. It closes the gap where a first HTTP request could be intercepted, and it saves a redirect for returning visitors.
The header
max-age sets how long, in seconds, the browser remembers the policy. includeSubDomains extends it to every subdomain. preload signals that you want the domain added to browsers' built-in HSTS list.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadPreloading
Browsers ship with a preload list of domains that are HTTPS-only from the very first visit. You can submit a domain at hstspreload.org if it meets the requirements, which include a max-age of at least one year, includeSubDomains and the preload directive. Removal from the list is possible but slow, because it has to flow through browser releases.
SEO relevance and risks
HSTS is a browser feature, not a crawler signal, and Googlebot does not cache HSTS policies the way browsers do. Its SEO value is indirect: fewer redirect hops for users and a cleaner HTTPS setup. The risk is availability. With includeSubDomains, any subdomain without a valid certificate becomes unreachable in browsers that have seen the policy, including internal tools.
Roll out in steps: start with a short max-age, confirm every subdomain serves HTTPS, then increase it.
Example
includeSubDomains breaks an old tool
Mossbeacon, a survey SaaS, adds HSTS with includeSubDomains and a one-year max-age. A legacy reporting tool at reports.mossbeacon.example still runs on plain HTTP, and staff browsers refuse to load it. The team issues a certificate for the subdomain, and next time tests with a short max-age first.
Common mistakes
Starting with a long max-age
Browsers remember the policy for the full period. Test with minutes or hours before committing to a year.
Preloading before every subdomain is ready
Preload applies to all subdomains. Inventory them before you submit.
Questions
There is no documented ranking effect from HSTS itself. It strengthens your HTTPS setup and can save users a redirect.
