ForHosting KIT · Developer Utilities

Build an HSTS header value

A lifetime of 31536000 seconds with both options on becomes one line: max-age first, then includeSubDomains, then preload. Paste it into your server or proxy rule without hand-joining fragments. Free in your browser.

Free
Runs in your browser
No sign-up
Your data stays on your device

Run — free How it works & API

Use it from WebAPIEmailTelegramApp soon

Worked example

If you enter

Max age: 31,536,000

You get

Value: max-age=31536000; includeSubDomains; preload

Invalid negative lifetimes and malformed field types are rejected instead of being converted into configuration that looks plausible but does not express the intended browser policy.

Choose max-age as a deliberate policy lifetime

A value of zero is valid and is commonly used to ask browsers to remove a previously stored HSTS policy. Positive values keep the policy active until the remembered lifetime expires or a later valid response replaces it. Choose the number according to your deployment and rollback plan rather than treating a long duration as a formatting detail.

The tool rejects fractional, missing, nonnumeric, and negative values because those inputs cannot safely represent the required whole-second directive.

Understand the reach of includeSubDomains and preload

Inventory delegated DNS zones and independently operated services before turning the flag on. The preload token is different: it expresses an intention associated with browser preload programs, but adding the word does not submit a domain, guarantee acceptance, or immediately change a browser list. Preload programs impose their own current eligibility and removal procedures, which should be reviewed separately before deployment.

This builder allows either flag independently because its job is deterministic header construction, not enforcement of a particular preload program's policy. When selected, the tokens use their conventional spellings and appear after max-age in stable order. When omitted or false, they do not appear at all.

Deploy and verify the generated value safely

Copy the returned value into the Strict-Transport-Security response header rather than treating it as a complete header line. For example, web-server configuration usually has one field for the header name and another for its value. Test the final response at the public edge because application code, a proxy, a content delivery network, or a hosting control panel may overwrite, duplicate, or strip the header.

A staged rollout can begin with a shorter positive lifetime, followed by monitoring and a planned increase after all relevant hosts prove reliable. If includeSubDomains is enabled, test representative nested hosts as well as the apex. If preload is enabled, separately confirm the chosen domain satisfies the browser program's requirements before submitting it.

The function is pure and deterministic: identical inputs always return the same string, no request leaves the runtime, and no configuration is stored.

What you can do with it

Generate reverse-proxy configuration

Turn reviewed HSTS settings into a stable value for a proxy, load balancer, or edge rule.

Standardize infrastructure templates

Produce the same directive spelling and order across environments without hand-built string branches.

Plan an HSTS rollout

Compare short, long, subdomain-wide, and preload-ready policy values before changing production responses.

FAQ

Does the result include the header name?

No. The value is intended for a Strict-Transport-Security header field configured by your server, proxy, or application.

Can max-age be zero?

Yes. Zero is a valid non-negative value and asks a supporting browser to expire its stored HSTS policy for that host.

Does adding preload put my domain on a preload list?

No. It only adds the token to the value. Browser preload programs have separate eligibility, submission, and removal processes.

Should I always enable includeSubDomains?

The directive extends the remembered policy throughout the domain tree.

What happens if I enter a negative or fractional lifetime?

It is rejected. The lifetime must be a whole number of seconds, zero or more, so negative, fractional, empty or non-numeric values never turn into a setting that looks right but does not say what you meant.

Related tools

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/security/hsts-header-build

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/security/hsts-header-build \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"max_age":31536000}'

const res = await fetch("https://api.kit.forhosting.com/security/hsts-header-build", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "max_age": 31536000
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/security/hsts-header-build",
    headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
    json={
    "max_age": 31536000
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/security/hsts-header-build", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => '{"max_age":31536000}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"max_age":31536000}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/security/hsts-header-build", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "max_age": 31536000
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "security.hsts_header_build",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Technical notes

This HSTS header value builder turns a lifetime in seconds and two clear boolean choices into a correctly ordered Strict-Transport-Security value. It always starts with the required max-age directive, then adds includeSubDomains and preload only when requested. The result is ready to place in an HTTPS response header, a reverse-proxy rule, or an infrastructure template.

Choose max-age as a deliberate policy lifetime

The required max-age directive tells a supporting browser how many seconds it should remember that a host must be reached only through HTTPS. This builder accepts that duration as a non-negative integer and writes it as the first directive, without exponential notation, rounding, or an added unit. Before increasing it, confirm that HTTPS works for every route users may visit, certificates renew reliably, and redirects do not hide an HTTP-only dependency. Its output is a header value only; your server or proxy remains responsible for attaching the Strict-Transport-Security field name to an HTTPS response.

Understand the reach of includeSubDomains and preload

Enable includeSubDomains when the HTTPS-only policy should cover the named host and every host below it. That choice can protect a whole domain tree, but it also means an overlooked development, vendor, or legacy subdomain may become unreachable if it lacks working HTTPS.

Deploy and verify the generated value safely

Send HSTS only over HTTPS; browsers ignore it when received through an insecure connection, and an HTTP redirect alone does not establish the remembered policy. Browser use is local; automated API requests cost $0.002 each.

Technical questions

What happens when max-age is negative?

The request fails with an invalid-input error, because a negative lifetime cannot form a valid max-age directive.

What does an API request cost?

Each API request costs $0.002. The same pure builder can run locally in the browser.

Read the full KIT documentation →

Run — free

Worked example

Choose max-age as a deliberate policy lifetime

Understand the reach of includeSubDomains and preload

Deploy and verify the generated value safely

What you can do with it

Generate reverse-proxy configuration

Standardize infrastructure templates

Plan an HSTS rollout

FAQ

Related tools

For developers — API access

API endpoint

Call it from your stack

Example request

Example response

Pricing

Errors

Technical notes

Choose max-age as a deliberate policy lifetime

Understand the reach of includeSubDomains and preload

Deploy and verify the generated value safely

Technical questions

thank you