HSTS Preload List Requirements

Updated April 2026

Last updated: April 2026

The HSTS preload list has strict requirements. Miss any one of them and your submission will be rejected. Here is exactly what you need before submitting at hstspreload.org.

The five requirements

1. Valid HTTPS certificate

Your domain must serve a valid, trusted TLS certificate. Self-signed certificates do not qualify. Free certificates from Let's Encrypt qualify.

2. HTTP redirects to HTTPS

All HTTP requests must redirect to HTTPS. The redirect must be a 301 (permanent) redirect, not a 302. Check with:

curl -sI http://yoursite.com | grep -i location

3. HSTS header with max-age ≥ 31536000

The Strict-Transport-Security header must have a max-age of at least 31536000 seconds (1 year). Shorter values will be rejected.

Strict-Transport-Security: max-age=31536000

4. includeSubDomains directive

Every subdomain of your domain must also support HTTPS. The preload list applies to the entire domain tree — not just the apex domain. If any subdomain serves only HTTP, users will be locked out after preloading.

Strict-Transport-Security: max-age=31536000; includeSubDomains

5. preload directive

The preload directive signals your intent to be on the preload list. It is not part of the HSTS standard — it is specifically for preload submission. Adding it without submitting does nothing, but submitting without it causes rejection.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Full Nginx config

server { listen 443 ssl; # Only set HSTS on HTTPS responses add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

server { listen 80; return 301 https://$host$request_uri;  # Redirect HTTP to HTTPS
}

Cloudflare

Cloudflare Dashboard → SSL/TLS → Edge Certificates → HSTS → Enable, set max-age to 12 months, enable includeSubDomains and preload. Do not enable until all subdomains support HTTPS.

Verification checklist before submitting

• ☐ Valid HTTPS certificate (check at HeadersFixer)
• ☐ HTTP redirects to HTTPS with 301
• ☐ HSTS header present on HTTPS responses
• ☐ max-age ≥ 31536000
• ☐ includeSubDomains present
• ☐ preload present
• ☐ All subdomains tested over HTTPS
• ☐ No subdomains serving HTTP-only content

After submission

Submit at hstspreload.org. Your domain will enter a queue and be included in the next Chrome release, followed by Firefox and Safari. This takes 2–3 months. Status can be checked via the API or the HSTS Preload Checker.

How to check if your domain is on the preload list

# Check status via hstspreload.org API
curl "https://hstspreload.org/api/v2/status?domain=yourdomain.com"

# Responses:
# {"status": "preloaded"}   already on the list
# {"status": "pending"}     submitted, waiting for Chrome release
# {"status": "unknown"}     not submitted
# {"status": "rejected", "message": "reason..."}

Add the HSTS header — per stack

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Cloudflare

# Dashboard → SSL/TLS → Edge Certificates → HSTS
# Max Age: 12 months | Include Subdomains: ON | Preload: ON
# Cloudflare sets the header automatically

Vercel

// vercel.json
{ "headers": [{ "source": "/(.*)", "headers": [
  { "key": "Strict-Transport-Security",
    "value": "max-age=31536000; includeSubDomains; preload" }
]}]}

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Netlify

[[headers]]
  for = "/*"
  [headers.values]
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"

How long does preloading take?

Chrome ships preload list updates roughly every 6-8 weeks. Expect 1-3 months from submission to active in Chrome. During the pending period, HSTS still works for returning visitors — the preload list only matters for first-time visitors who have never loaded your site.

Removal warning

Removal from the preload list takes 6-12 months to fully propagate. Before submitting, confirm that every subdomain serves valid HTTPS. If any subdomain is HTTP-only, includeSubDomains; preload will break it for Chrome users and cannot be quickly undone.