Search code examples
hsts

hsts preload without being listed?


What is the effect of the preload directive if it is included before the site is listed?

I'm hoping it just has no effect but I'm struggling to find any solid info and I'm nervous of it leading to problems.


Solution

  • It has no other effect to the browser other than to make it eligible to be included in the preload list.

    Sites MUST include this directive before submitting it for inclusion in the preload list as this is checked to avoid accidental preloading. But once it's on there then browsers may pick it up (even if you don't explicitly submit it).

    Do be sure you 100% definitely want to include your site in HSTS preloading. Many, many sites have done this without thinking it through completely and then had to request removal and wait months for this to happen, either because they didn't fully understand the consequences or they need HTTP-only sites on that domain. Preloading is basically irreversible and you are right to be nervous. To be honest I'm of the opinion that it's overkill for most sites, but others may disagree.