# What Is HSTS Preload (HSTS preload list)? Definition and Examples

> HSTS preload is a list of domains built into browsers that are always contacted over HTTPS, protecting even the first visit before any HSTS header is seen.

Source: https://ssl.sh/glossary/hsts-preload/
Last updated: 2026-11-10

The HSTS preload list is maintained by the Chromium project, and submissions go through hstspreload.org; Chrome, Firefox, Safari and Edge all ship lists derived from it. A preloaded domain, together with all its subdomains, is hard-coded into the browser, so the browser never makes a plaintext HTTP request to it, even on a fresh install. Whole top-level domains can be preloaded too: `.app` and `.dev` are examples, which is why sites on them must use HTTPS from day one.

## Why it matters
Ordinary [HSTS](https://ssl.sh/glossary/hsts/) relies on the browser having seen the header before, which leaves the first visit open to [SSL stripping](https://ssl.sh/glossary/ssl-stripping/). Preloading closes that gap, but the commitment is heavy. Only the registrable domain (`example.com`, not `www.example.com`) can be submitted, and it must have a valid certificate, redirect HTTP to HTTPS on the same host, and send an HSTS header with `includeSubDomains`, `preload` and a `max-age` of at least one year (31536000 seconds). Every subdomain that a browser might visit, including intranet tools, must then work over HTTPS. Removal is possible but slow: it ships with browser releases, and older browser versions keep the entry.

## Example
The header a preload candidate must return on `https://example.com`:

```text
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

Before submitting, inspect what the apex domain actually returns with the [HSTS checker](https://ssl.sh/tools/hsts-checker/) and list every subdomain in use.

## Common misconceptions
- **Adding `preload` to the header puts you on the list.** The directive only signals consent; the domain must be submitted, accepted and then shipped in browser releases.
- **Preloading can be undone quickly.** Removal takes a browser release cycle to reach users, and outdated browsers keep the entry for good, so treat it as permanent.
- **Only the main website is affected.** `includeSubDomains` applies to every subdomain, so an HTTP-only admin page or device interface under the domain becomes unreachable in browsers.

## Related terms

- [HSTS](https://ssl.sh/zh/glossary/hsts/): HSTS 是一个 HTTP 响应头，告诉浏览器在指定时间内只通过 HTTPS 访问该站点，并且遇到证书错误时不允许用户继续访问。
- [SSL 剥离](https://ssl.sh/zh/glossary/ssl-stripping/): SSL 剥离是一种中间人攻击，攻击者截获本应把用户引向 HTTPS 的跳转或链接，让用户一直停留在明文 HTTP 上。
- [HTTPS](https://ssl.sh/zh/glossary/https/): HTTPS 是在 TLS 加密连接之上传输的 HTTP，默认使用 443 端口，使网页内容、Cookie 和表单数据被加密，并验证服务器身份。
- [混合内容](https://ssl.sh/zh/glossary/mixed-content/): 混合内容是指通过 HTTPS 加载的页面中，部分脚本、图片、iframe 等子资源仍通过明文 HTTP 加载，削弱了整个页面的安全性。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。