HSTS: how browsers enforce HTTPS

HTTP Strict Transport Security lets an HTTPS origin tell supporting browsers to use HTTPS for a period of time. includeSubDomains broadens the policy; preload is a separate browser ecosystem mechanism and should not be enabled casually.

What HSTS changes in the browser

HSTS tells a browser to use HTTPS only for a site during the advertised max-age. Once the policy has been received, the browser upgrades later HTTP navigations to HTTPS before sending an ordinary unencrypted request.

How to check HSTS

Inspect the Strict-Transport-Security response header and its max-age. Before using includeSubDomains, make sure the required subdomains work over HTTPS. Treat preload as a separate, longer-lived commitment rather than a routine HSTS switch. For a practical check, use 2ip server check. You can cross-check the site's external HTTP response with 2ip site information check.

Be careful with includeSubDomains and preload

Technical references: RFC 6797.