The Complete Production SOP: How to Deploy and Run HTTP Strict Transport Security (HSTS) Preload in Autonomous AI Agents

---
name: "hsts-preload-header-hardening"
description: "Force HTTPS connections and eliminate SSL stripping attacks with HSTS Preload."
metadata:
  author: "Chromium HSTS"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure hsts header"
  - "submit domain to hsts preload"
  - "prevent ssl stripping hsts"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Redirect HTTP (Port 80) to HTTPS (Port 443)
server {
    listen 80;
    listen [::]:80;
    server_name example.com *.example.com;
    return 301 https://$host$request_uri;
}

# Secure HTTPS Server (Port 443)
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # Enforce RFC 6797 HSTS Preload Directive
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
}

#!/usr/bin/env bash
set -euo pipefail

TARGET_URL="${1:-https://localhost}"
HEADER=$(curl -sIk "$TARGET_URL" | tr -d '\r' | grep -i "^Strict-Transport-Security:")

echo "Inspecting Header: $HEADER"

if [[ "$HEADER" =~ max-age=([0-9]+) ]]; then
    AGE="${BASH_REMATCH[1]}"
    if [ "$AGE" -lt 31536000 ]; then
        echo "ERROR: max-age is $AGE, must be >= 31536000" >&2
        exit 1
    fi
else
    echo "ERROR: Missing max-age directive" >&2
    exit 1
fi

if ! echo "$HEADER" | grep -q "includeSubDomains"; then
    echo "ERROR: Missing includeSubDomains directive" >&2
    exit 1
fi

if ! echo "$HEADER" | grep -q "preload"; then
    echo "ERROR: Missing preload directive" >&2
    exit 1
fi

echo "SUCCESS: HSTS Preload criteria verified."