Safety
HSTS vs HTTPS Redirects for Marketing Site Safety
March 28, 2024
HSTS vs HTTPS redirects is not a contest with one winner. A redirect sends this visit to HTTPS. HTTP Strict-Transport-Security tells supporting browsers to remember HTTPS for a max-age, cutting off later cleartext first hops. Marketing sites that only redirect still lose the first request and any client that ignores the redirect. Sites that only set HSTS without a working HTTPS listener strand visitors. The durable setup is: TLS on, permanent redirect, then HSTS with a long max-age once you are sure HTTPS will not be turned off.
The practical difference
A 301 or 308 from http:// to https:// is a traffic rule. It runs when the client speaks HTTP first. Attackers on the network still get a shot at that first request unless the browser already knows to upgrade.
HSTS is a memory rule. After a browser sees Strict-Transport-Security on a trusted HTTPS response, later visits skip HTTP. includeSubDomains and preload are extra commitments, not casual flags.
How to choose based on how ready TLS is
If any important subdomain still needs HTTP, do not set includeSubDomains. If you might roll back HTTPS next week, do not set a two-year max-age and do not submit to the preload list.
If the marketing site and www already live on HTTPS with a working certificate, turn on HSTS at the edge with a max-age you can live with (often six months to two years) and keep the redirect for clients that have never seen the header.
| Control | What it fixes | What it does not fix | Takeaway |
|---|---|---|---|
| HTTPS redirect | This request's cleartext URL | The first hop for new browsers; mixed content inside the page | Required, not sufficient |
| HSTS | Later first hops for browsers that cached the policy | Users who never received the header; non-browser clients | Required once HTTPS is stable |
| HSTS preload | First visit for browsers using the preload list | Operational mistakes — you cannot casually undo it | Only after subdomains are ready |
When a redirect-only setup fails OPSEC
Redirect-only fails when someone types the bare host, follows an old http:// campaign link, or a proxy strips upgrades. It also fails if the HTML still loads http:// scripts or images — mixed content is a separate finding on RoastMyOpsec's deeper vault checks.
The free audit flags a cleartext or soft HTTPS story when the submitted URL or its redirect target is not HTTPS.
Common mistakes
The first mistake is HSTS on a host that still serves a broken certificate on some regions.
The second mistake is max-age=0 left over from a test, which tells browsers to forget HSTS.
The third mistake is redirecting to HTTPS while the canonical tags, sitemaps, and ads still advertise HTTP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is HSTS or an HTTPS redirect better?
- You want both. The redirect covers this visit. HSTS covers later visits for browsers that stored the policy.
- What HSTS max-age should a marketing site use?
- Once HTTPS is stable, a long max-age (often 15552000 seconds or more) is the usual production setting. Start shorter only while you are still proving TLS will stay on.
- Should I preload HSTS?
- Only after every subdomain you include is HTTPS-ready and you understand that removal from the preload list is slow. Most brochure sites can wait.