How to Enable HSTS preload header on Webflow?

HSTS (HTTP Strict Transport Security) is a security header that tells browsers to always connect to your site over HTTPS, never HTTP — even if a user types the HTTP version of your URL. It prevents protocol downgrade attacks, where an attacker intercepts a connection before HTTPS is established and serves malicious content over the unencrypted channel.

HSTS preloading takes this further. Browser vendors maintain a hardcoded list of domains that are always loaded over HTTPS — the HSTS preload list. Sites on this list are HTTPS-only from the very first request, before a browser has ever seen any HSTS header. For regular HSTS, the first visit might still go through a brief HTTP request before the header is received and cached. Preload eliminates that window entirely.

How HSTS works: when your server sends the Strict-Transport-Security header, the browser caches it. For the duration of the max-age value (typically one year = 31536000 seconds), the browser refuses HTTP connections and automatically uses HTTPS. The includeSubDomains directive extends this to all subdomains.

Checking your current HSTS configuration: visit securityheaders.com or run a header check tool on your domain. Look for the Strict-Transport-Security response header. For Webflow-hosted sites with SSL enabled, Webflow sends this header — check what max-age and directives are currently set.

Getting on the HSTS preload list: visit hstspreload.org. To qualify: HTTPS with a valid certificate, HTTP-to-HTTPS redirect, HSTS header with max-age of at least 31536000, includeSubDomains directive, and the preload directive. Submission to inclusion can take weeks to months via browser updates.

The critical caveat: HSTS preload is difficult to undo. Once your domain is on the list, it takes 6–12 months to remove, and browsers enforce it until they update. Only submit if you're committed to HTTPS on all subdomains indefinitely. Submitting prematurely — before all subdomains have SSL — is a common mistake that breaks those subdomains for all users with a cached browser update.

Monthly check: verify your HSTS header is present with the correct max-age. If you've submitted to the preload list, check hstspreload.org for your domain's current status. For most Webflow sites, the standard HSTS header is sufficient. Preload is worth considering if security compliance or enterprise trust signals matter to your audience.