# hsts

> HTTP Strict Transport Security middleware.

Latest version **2.2.0** (published 2019-03-10) · MIT license · 0 weekly downloads

## Install

```sh
npm install hsts
pnpm add hsts
yarn add hsts
bun add hsts
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.2.0 |
| Published | 2019-03-10 |
| First published | 2014-10-28 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=4.0.0 |
| Dependencies | 1 |
| Unpacked size | 7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 86 |
| Author | Adam Baldwin |
| Maintainers | evanhahn |
| Keywords | helmet, security, express, connect, hsts, https |

## Links

- npm: https://www.npmjs.com/package/hsts
- Repository: https://github.com/helmetjs/hsts
- Homepage: https://helmetjs.github.io/docs/hsts/
- Issues: https://github.com/helmetjs/hsts/issues
- npm.io page: https://npm.io/package/hsts

## Dependencies (1)

- [depd](https://npm.io/package/depd.md) 2.0.0

## Recent versions

- 2.2.0 (latest) — 2019-03-10
- 2.1.0 — 2017-07-21
- 2.0.0 — 2016-10-28
- 1.0.0 — 2015-12-18
- 0.2.0 — 2015-09-22
- 0.1.3 — 2015-06-02
- 0.1.2 — 2015-04-22
- 0.1.1 — 2015-03-23
- 0.1.0 — 2014-10-28

## README

HTTP Strict Transport Security middleware
========================================
[![Build Status](https://travis-ci.org/helmetjs/hsts.svg?branch=master)](https://travis-ci.org/helmetjs/hsts)
[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com/)

This middleware adds the `Strict-Transport-Security` header to the response. This tells browsers, "hey, only use HTTPS for the next period of time". ([See the spec](http://tools.ietf.org/html/rfc6797) for more.) Note that the header won't tell users on HTTP to *switch* to HTTPS, it will just tell HTTPS users to stick around. You can enforce HTTPS with the [express-enforces-ssl](https://github.com/aredo/express-enforces-ssl) module.

This will set the Strict Transport Security header, telling browsers to visit by HTTPS for the next 180 days:

```javascript
const hsts = require('hsts')

app.use(hsts({
  maxAge: 15552000  // 180 days in seconds
}))
// Strict-Transport-Security: max-age: 15552000; includeSubDomains
```

Note that the max age must be in seconds. *This was different in previous versions of this module!*

The `includeSubDomains` directive is present by default. If this header is set on *example.com*, supported browsers will also use HTTPS on *my-subdomain.example.com*. You can disable this:

```javascript
app.use(hsts({
  maxAge: 15552000,
  includeSubDomains: false
}))
```

Some browsers let you submit your site's HSTS to be baked into the browser. You can add `preload` to the header with the following code. You can check your eligibility and submit your site at [hstspreload.org](https://hstspreload.org/).

```javascript
app.use(hsts({
  maxAge: 31536000,        // Must be at least 1 year to be approved
  includeSubDomains: true, // Must be enabled to be approved
  preload: true
}))
```

This header will always be set because [the header is ignored in insecure HTTP](https://tools.ietf.org/html/rfc6797#section-8.1). You may wish to set it conditionally:

```javascript
const hstsMiddleware = hsts({
  maxAge: 1234000
})

app.use((req, res, next) => {
  if (req.secure) {
    hstsMiddleware(req, res, next)
  } else {
    next()
  }
})
```

This header is [somewhat well-supported by browsers](https://caniuse.com/#feat=stricttransportsecurity).

---
_Source: https://npm.io/package/hsts · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._