Translations

If this optional parameter is specified, this rule applies to all of the site's subdomains as well.

If this optional parameter is specified, this rule applies to all of the site's subdomains as well.

Note: Do not include the preload directive by default if you maintain a project that provides HTTPS configuration advice or provides an option to enable HSTS. Be aware that inclusion in the preload list cannot easily be undone. Domains can be removed, but it takes months for a change. Check <a id="hsts-info-link" target="_blank" href="%s">here</a> for more information.

Note: Do not include the preload directive by default if you maintain a project that provides HTTPS configuration advice or provides an option to enable HSTS. Be aware that inclusion in the preload list cannot easily be undone. Domains can be removed, but it takes months for a change. Check <a id="hsts-info-link" target="_blank" href="%s">here</a> for more information.

Google maintains an HSTS preload service. By following the guidelines and successfully submitting your domain, browsers will never connect to your domain using an insecure connection.

Google maintains an HSTS preload service. By following the guidelines and successfully submitting your domain, browsers will never connect to your domain using an insecure connection.

HSTS Preload

HSTS Preload

The HTTP Strict-Transport-Security response header (HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP. This is extremely important for websites that store and process sensitive information like ECommerce stores and helps prevent Protocol Downgrade and Clickjacking attacks.

The HTTP Strict-Transport-Security response header (HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP. This is extremely important for websites that store and process sensitive information like ECommerce stores and helps prevent Protocol Downgrade and Clickjacking attacks.

Send a full URL (stripped from parameters) when performing a a same-origin or cross-origin request.

Send a full URL (stripped from parameters) when performing a a same-origin or cross-origin request.

Send a full URL when performing a same-origin request, only send the origin of the document to a-priori as-much-secure destination (HTTPS->HTTPS), and send no header to a less secure destination (HTTPS->HTTP).

Send a full URL when performing a same-origin request, only send the origin of the document to a-priori as-much-secure destination (HTTPS->HTTPS), and send no header to a less secure destination (HTTPS->HTTP).

Only send the origin of the document as the referrer to a-priori as-much-secure destination (HTTPS->HTTPS), but don't send it to a less secure destination (HTTPS->HTTP).

Only send the origin of the document as the referrer to a-priori as-much-secure destination (HTTPS->HTTPS), but don't send it to a less secure destination (HTTPS->HTTP).

A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information.

A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information.

Send a full URL when performing a same-origin request, but only send the origin of the document for other cases.

Send a full URL when performing a same-origin request, but only send the origin of the document for other cases.

Only send the origin of the document as the referrer in all cases. The document https://example.com/page.html will send the referrer https://example.com/.

Only send the origin of the document as the referrer in all cases. The document https://example.com/page.html will send the referrer https://example.com/.

This is the user agent's default behavior if no policy is specified. The origin is sent as referrer to a-priori as-much-secure destination (HTTPS->HTTPS), but isn't sent to a less secure destination (HTTPS->HTTP).

This is the user agent's default behavior if no policy is specified. The origin is sent as referrer to a-priori as-much-secure destination (HTTPS->HTTPS), but isn't sent to a less secure destination (HTTPS->HTTP).

The Referer header will be omitted entirely. No referrer information is sent along with requests.

The Referer header will be omitted entirely. No referrer information is sent along with requests.

Referrer Information

Referrer Information

Choose which referrer information to send along with requests.

Choose which referrer information to send along with requests.