How does HSTS protect websites and subdomains?

HSTS protects websites by having browsers subject to the policy use HTTPS directly, rather than first sending an unencrypted HTTP request and waiting for the website to redirect them. Whether subdomains are also covered depends on whether the policy includes the includeSubDomains directive. Enabling HSTS on the primary domain does not, by itself, mean that all subdomains are covered. HSTS Preload lets browsers use HTTPS based on a preload list, but the website and its subdomains must meet the relevant requirements.

Browsers switch to HTTPS before making a request, rather than waiting for a server redirect

According to the explanation in Semrush’s 2014 article, a server uses an HTTP response header named Strict-Transport-Security to tell browsers that secure connections are required. The max-age value specifies how long browsers should maintain this secure-connections-only policy.

For example, if a user enters an HTTP URL or follows an old link that still uses HTTP, a browser subject to that website’s HSTS policy will switch to HTTPS before sending the request. This differs from first connecting to the website over HTTP and switching to HTTPS only after receiving a redirect: the former avoids the HTTP redirect and reduces the opportunity for an unencrypted request to be intercepted or tampered with. The key condition is that the policy must already apply; this protection cannot be assumed unconditionally for every visit.

Subdomains must be explicitly included in the policy

The same article explains that adding the includeSubDomains directive requires browsers to use HTTPS for subdomains as well. For example, if the policy for yourwebsite.com includes this directive, urblog.yourwebsite.com is also covered.

• The primary domain’s HSTS configuration and whether the policy extends to subdomains are two separate items to verify.
• Before enabling HSTS, confirm that the web server supports it and check the relevant HTTPS and certificate settings.
• Do not stop at confirming that the main website supports secure connections; also check the subdomains you intend to include in the policy.

The preload list provides another way for the policy to apply

HSTS Preload, as described in Semrush’s 2020 article, lets browsers identify websites that should use HTTPS based on a preload list. Even if a user attempts to open a website over HTTP, the browser will use HTTPS instead. This also avoids a redirect when following old external links that point to HTTP URLs.

However, configuring HSTS and joining the preload list are not the same thing. The article explicitly states that preloading has multiple requirements, and its benefits depend on the website and its subdomains meeting those requirements. The supplied material does not list all of the conditions, so this explanation is limited to how preloading works; the 2020 article cannot be treated as current submission rules or a complete deployment checklist.