HSTS
Also called: http strict transport security, strict transport security
HSTS (HTTP Strict Transport Security) is a response header, Strict-Transport-Security, that tells browsers to load a site over HTTPS only and to automatically upgrade any http:// request to https://, so no insecure connection is attempted after the first visit.
The header is only honored when delivered over HTTPS (browsers ignore it over plain HTTP so an attacker cannot forge it or expire it early), and it carries up to three directives.
Strict-Transport-Security: max-age=31536000; includeSubDomainsmax-age sets how long, in seconds, the browser remembers the HTTPS-only rule. includeSubDomains extends it to every subdomain. preload opts you into the browser-maintained preload list used by Chrome, Firefox, Safari, and Edge, which requires max-age of at least 31536000 (one year) plus includeSubDomains.
The first visit still uses one redirect
On a cold first visit to http://, the browser has no stored policy, so it follows your normal 301 to HTTPS and only then reads the header. Every visit after that, it rewrites http:// to https:// internally with no server round trip. Preloading closes even that first-visit gap by hard-coding the domain into the browser itself. Note that hstspreload.org now says preloading is not recommended for most sites, since current browsers already auto-upgrade most HTTP navigations to HTTPS and the extra benefit is minimal.
The security payoff is blocking SSL stripping and man-in-the-middle downgrades. Someone on shared Wi-Fi cannot force a visitor back onto plain HTTP, and users cannot click through a forged certificate warning.
How it affects your traffic
HSTS is not a direct ranking factor, but it protects the HTTPS setup that Google treats as a lightweight positive signal, and it removes the repeated http-to-https redirect hop that slows first paint and wastes crawl budget. A misconfigured header (too-short max-age, missing includeSubDomains, or serving it over HTTP where browsers ignore it) leaves the same downgrade and mixed-content risks HTTPS was meant to fix. Getting HSTS, redirects, and certificates set correctly is the kind of plumbing our Technical SEO work locks down, so crawlers and AI answer engines only ever reach clean, secure URLs.
Get Technical SEO that moves the needle
We turn terms like this into ranked pages and qualified pipeline. Start with a free Initial SEO Strategy.