HTTP Strict Transport SecurityBaseline · Widely available
The Strict-Transport-Security HTTP response header informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. Also known as HSTS.
Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Jul 29, 2015. Widely available since Jan 29, 2018.
Browser support
DesktopChrome
1–3Not supported
4+Supportedsince Jan 25, 2010
Current: 155Edge
12+Supportedsince Jul 29, 2015
Current: 154Firefox
1–3.6Not supported
4+Supportedsince Mar 22, 2011
Current: 157Safari
1–6Not supported
7+Supportedsince Oct 22, 2013
Current: 27MobileChrome Android
18+Supportedsince Jun 27, 2012
Current: 155Firefox Android
4+Supportedsince Mar 29, 2011
Current: 157Safari iOS
1–6Not supported
7+Supportedsince Sep 18, 2013
Current: 27How to use
This feature is Baseline widely available — use it freely, no fallback needed.
Example
Full syntax and examples are on MDN: Strict-Transport-Security.
Feature detection
There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.