ShipGuardScan a site

HSTS Setup on Vercel and Netlify

Updated 2026-10-17

HSTS tells browsers to use HTTPS for your domain for a period of time, preventing downgrade attacks on later visits.

Vercel

Use next.config headers (see the v0 guide) or vercel.json:

{
  "headers": [{ "source": "/(.*)", "headers": [
    { "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }
  ]}]
}

Netlify

Add a _headers file to your publish directory:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Preload carefully

Only add preload and submit to the preload list once every subdomain supports HTTPS — removal is slow.

Checklist

  • HSTS on HTML responses
  • max-age ≥ 15552000 (180 days); 1 year recommended
  • includeSubDomains once subdomains are HTTPS
  • HTTP redirects to HTTPS

Copy-paste fix prompt

Add a Strict-Transport-Security header (max-age=31536000; includeSubDomains) to every response using my host's header config, and make sure http:// permanently redirects to https://.

FAQ

Can HSTS break my site?

Only if some subdomain cannot serve HTTPS and you used includeSubDomains or preload. Start without preload.

Does HSTS replace a redirect?

No. Keep the HTTP→HTTPS redirect for first-time visitors.

Check your deployed app in ~25 seconds

Free passive scan: leaked keys, Supabase exposure, public config files and headers.

Run a free scan

Related