Safety
HSTS max-age Six Months vs Two Years
March 11, 2024
HSTS max-age six months vs two years is how long supporting browsers remember to skip HTTP after they see Strict-Transport-Security on HTTPS: six months is 15552000 seconds — the bar RoastMyOpsec uses when it flags a short max-age — and two years (63072000) is a longer memory and a harder rollback. Preload lists typically want at least one year plus includeSubDomains and a preload token; that is a public-list decision, not a header beauty contest. RoastMyOpsec reads HSTS on the landing HTTPS response — it does not require two years, submit the domain to the preload list, or probe every subdomain.
The practical difference
max-age is a cache of 'use HTTPS' for this host. includeSubDomains extends that memory to names under the registrable domain once a browser has learned HSTS from this response. preload is a Chromium (and other) list so even the first visit can skip HTTP — removal is slow.
A redirect from HTTP to HTTPS still covers this request. HSTS covers later first hops for browsers that stored the header. max-age=0 is how you tell browsers to forget, which is a rollback tool, not a production default. An expired certificate plus a long max-age is a lockout, not a trophy.
How to choose based on what you shipped
HTTPS stable on this host, no plan to go back to HTTP: start at six months, keep the redirect, then raise max-age when you are comfortable. Two years wins when the site is a fixture and you already survive cert renewals. Do not set two years and includeSubDomains while a blog or mail name still speaks HTTP.
Preload only after an inventory of every DNS name you include, a long max-age that meets the list rules, and a staging period with the preload token. Most brochure sites never need the list.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| max-age ≈ six months (15552000) | HTTPS is stable; you still want a shorter rollback window | First-time visitors still need a redirect until they cache HSTS | Meets a common scanner floor; not preload by itself |
| max-age ≈ two years (63072000) | Long-lived public origin, cert automation is boring | Turning HTTPS off becomes a long apology | Strong memory; still not a preload submission |
| max-age under six months or missing | Active TLS rollback or a staged enable | Browsers forget quickly; first hops stay HTTP-shaped | The roast may flag short or missing HSTS |
| HSTS preload list | Every included name is HTTPS-ready and you accept slow removal | Submitting without includeSubDomains and a long max-age | Optional; RoastMyOpsec will not submit you |
When six months still wins
Six months still wins during a CDN or origin migration, after a cert scare, or when a sibling subdomain's HTTPS story is not done. Two years still wins on a boring brochure origin with automated renewal and no HTTP leftovers.
Neither duration replaces a working redirect or a valid certificate. Preload is not a roast requirement and is not performed by the scan.
Common mistakes
The first mistake is max-age=0 left in production after a test.
The second mistake is two years plus includeSubDomains while staging.example still serves HTTP.
The third mistake is treating missing preload as a RoastMyOpsec fail.
What a URL roast can prove
On the audited HTTPS response, RoastMyOpsec flags missing Strict-Transport-Security or a max-age under 15552000 seconds (six months). A six-month policy can pass that check; two years is not extra credit on the score. The TLS check is HTTPS scheme and trust-store acceptance, not a cipher or min-version lab. The scan does not submit HSTS preload, does not verify includeSubDomains across your zone, and does not score GPC. Pair HSTS with a permanent HTTP-to-HTTPS redirect. Header read only — no exploit payloads.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is two-year HSTS better than six months?
- It remembers longer. It is also harder to undo. Six months is a solid production floor once HTTPS will stay on. Choose from rollback risk, not from a trophy number.
- Does RoastMyOpsec require a two-year max-age?
- No. It flags missing HSTS or max-age under six months. It does not require two years and does not submit preload.
- Does a long max-age replace the HTTPS redirect?
- No. New browsers still need a redirect (or preload) for the first visit. Keep both once TLS is stable.