How to get your site on the HSTS preload list
The preload list is built into browsers, so they use HTTPS on your site from the very first visit, before they have ever seen your HSTS header.
Getting off the list takes months. Submit only when every subdomain works over HTTPS and none will ever need plain HTTP.
How to fix it
Your web server
Where: your Strict-Transport-Security header, then hstspreload.org
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Then submit your domain at https://hstspreload.org to be hardcoded into browsers.
Preloading means browsers enforce HTTPS on the very FIRST visit — closing the initial-request SSL-strip window. Requires max-age >= 1 year + includeSubDomains + preload.
How to confirm: After submitting, the preload status flips to 'pending' then 'preloaded'.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site freeRelated guides
- How to add the HSTS header to your site
- How to add the X-Frame-Options header (clickjacking protection)
- How to add X-Content-Type-Options: nosniff
- How to add the Referrer-Policy header
- How to add the Permissions-Policy header
- How to add a Content-Security-Policy (CSP)
- How to remove unsafe-inline from your CSP