hstspreload.org, as data

A site that enables HSTS helps protect its users from the following attacks done by an on-path attacker:* **Browsing history leaks**: If a user clicks on an HTTP link to a site, an on-path network observer can see that URL. If the site has an HSTS policy that is enforced, the browser upgrades that URL to HTTPS and the path is not visible to the network observer.* **Protocol downgrades**: If a site redirects from HTTP to HTTPS, an on-path network attacker can intercept and re-write the redirect to keep the browser using plaintext HTTP.* **Cookie hijacking**: On HTTP requests, an on-path network attacker can see and modify cookies. Even if the site redirects to HTTPS, the on-path attacker can inject cookies into the redirect response.## Deployment RecommendationsIf your site is committed to HTTPS and you want browsers to enforce that your page is loaded only over HTTPS, we suggest the following steps to enable HSTS:1. Examine all subdomains (and nested subdomains) of your site and make sure that they work properly over HTTPS.* **Note:** This also includes internal subdomains that are not publicly accessible.* Add the `Strict-Transport-Security` header to all HTTPS responses and ramp up the `max-age` in stages, using the following header values:`max-age=300; includeSubDomains``max-age=604800; includeSubDomains``max-age=2592000; includeSubDomains`During each stage, check for broken pages and monitor your site's metrics (e.g. traffic, revenue). Fix any problems that come up and then wait the full `max-age` of the stage before you move on. For example, wait a month in the last stage.If you have a group of employees or users who can beta test the deployment, consider trying the first few ramp-up stages on those users. Then make sure to go through all stages for all users, starting over from the beginning.