AnyProxy

Get Pro
Glossary · Web tech

HSTS

Also calledhttp strict transport security
Definition

HSTS (HTTP Strict Transport Security) is a header that tells browsers to use only HTTPS for a site for a set period, so a network cannot quietly downgrade you to unencrypted HTTP.

Explanation

In depth

The first time you type a bare address, a browser may try plain HTTP before being redirected to HTTPS, and someone on the network could intercept that first request. HSTS, defined in RFC 6797, closes the gap for later visits. The site sends a Strict-Transport-Security header with a max-age in seconds, and the browser refuses plain HTTP for that site until it expires. includeSubDomains extends the rule to every subdomain. The preload directive only asks to be added to the HSTS preload list built into browsers. It does not add you by itself; the site must be submitted and accepted. Real headers show how easily HSTS is done wrong. In the 5 October 2026 DomainScan scan, croxyproxy.com and blockaway.net each sent two values, max-age=0 followed by max-age=15768000. Browsers act on the first, and max-age=0 means 'forget this site'. anyproxy.site sent max-age=63072000 (two years) with includeSubDomains and preload. On 15 October 2026, though, hstspreload.org reported its status as unknown: it is not on the preload list yet, so the first-ever visit is not covered. HSTS protects against downgrades, not against DNS or SNI blocking.

In practice

HSTS in the real world

Header values from the 5 Oct 2026 DomainScan scan: anyproxy.site sends max-age=63072000; includeSubDomains; preload. croxyproxy.com and blockaway.net send 'max-age=0, max-age=15768000; includeSubDomains', and proxyium.com sends max-age=31536000 without preload. Among popular sites, discord.com, facebook.com, netflix.com, reddit.com, spotify.com, wikipedia.org and youtube.com are flagged as preloaded. The preload directive alone proves nothing: anyproxy.site sends it but was still not listed on hstspreload.org on 15 Oct 2026.

Sources: RFC 6797 — HTTP Strict Transport Security · hstspreload.org status for anyproxy.site · AnyProxy vs CroxyProxy — measured headers

Measured · 2026-10-05

HSTS on popular sites and proxies

From a DomainScan scan of 37 popular sites and our homepage measurements of free web proxies.

On the browser preload list7 sites: YouTube, Facebook, Reddit, Discord, Wikipedia, Spotify, Netflix
HSTS sent, not preloaded21 sites: Vimeo, Twitch, Instagram, TikTok, X, Snapchat, Pinterest, BBC, Al Jazeera, The Guardian, Reuters, WhatsApp Web, Telegram, Messenger, Bing, DuckDuckGo, ChatGPT, Perplexity, SoundCloud, Disney+, eBay
Proxies sending max-age=0 firstCroxyProxy, BlockAway
anyproxy.sitemax-age=63072000; includeSubDomains; preload

Questions about HSTS

What does HSTS max-age=0 mean?
It tells the browser to delete any HTTPS-only rule stored for that site. When it comes first in a duplicated header, it switches the protection off.
Does the preload directive put a site on the preload list?
No. It signals consent. The domain must be submitted at hstspreload.org and shipped in a browser release before first visits are protected.
Does HSTS help unblock sites?
No. It stops downgrades to plain HTTP. DNS, IP and SNI blocking all work on HTTPS connections too.

Related terms

TLS handshakeThe TLS handshake is the opening exchange of every HTTPS connection, in which browser and server agree on encryption keys and the server proves which site it is.HTTPS proxyAn HTTPS proxy is a proxy you connect to over an encrypted (TLS) link, so even the name of the site you ask it for is hidden from your local network.MITM (Man-in-the-Middle)A man-in-the-middle (MITM) is anything that sits between you and a website and can read or change the traffic, whether as an attack, as company policy or as a service you chose.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page