---
schema_version: "1"
id: 348170d0088a35f6394e315db4c851efb566dafaaf8571f7092465610cbff77a
title: Enable HSTS Preloading on a Custom Domain
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_hsts_preloading.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_hsts_preloading.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 50759f0895df9cc987db8dfdebccaeea087b992864e0b042807cb80d23e33010
description: As a security best practice, enable and submit your custom domain for HTTP Strict Transport Security (HSTS) preloading. Connections can be vulnerable when HTTP requests are redirected to HTTPS. An example is a user attempting to access your custom domain using the HTTP protocol. By adding your registrable domain to the third-party HSTS preload list, supported browsers always use HTTPS, protecting your users from attacks during those HTTP redirections.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Enable HSTS Preloading on a Custom Domain

As a security best practice, enable and submit your custom domain for HTTP Strict Transport Security (HSTS) preloading. Connections can be vulnerable when HTTP requests are redirected to HTTPS. An example is a user attempting to access your custom domain using the HTTP protocol. By adding your registrable domain to the third-party HSTS preload list, supported browsers always use HTTPS, protecting your users from attacks during those HTTP redirections.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Applies to: Salesforce Sites and <a href="https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&amp;language=en_US" target="_blank">LWR, Aura, and Visualforce sites</a></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d192373e78">User
              Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d192373e78 ">To view a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d192373e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d192373e78 ">To edit a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d192373e78 ">Manage Custom Domains</td>

          </tr>
        </tbody>
      </table>

The [`Strict-Transport-Security`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) HTTP header informs browsers to always use HTTPS, a secure connection, to access the domain. However, the first time a user accesses a domain, an HTTP-only connection can be vulnerable while the browser interprets that instruction.

HSTS preloading helps to mitigate this issue. If your domain is on that list, browsers that use the list always treat that domain as requiring a secure connection. For a list of the browsers that support HSTS preloading, see [https://hstspreload.org](https://hstspreload.org). To add your domain to the list, you enable the `Strict-Transport-Security` HTTP header on the registrable domain. Then you add that domain to the third-party HSTS preload list.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note Only registrable domains are eligible for HSTS preloading. A registrable domain, —sometimes called a root domain or naked domain—is the domain’s public suffix, such as .com or .org, plus the label to the left of that suffix. An example is example.com without the www subdomain. So, `example.com` and `example.co.uk` are eligible for HSTS preloading, but `www.example.com`, `www.example.co.uk`, and `sub.example.com` aren’t eligible.

To enable HSTS on a custom domain that serves your site content, complete these steps.

1. Enable HSTS preloading on the `Strict-Transport-Security` HTTP header for your custom domain’s registrable domain.
    
    1. If your domain in Salesforce is a registrable domain such as https://example.com, select **Allow HSTS preloading registration** on the domain. To access this setting, edit your domain from the Domains Setup page.
        
        When that setting is enabled, Salesforce includes the `preload` directive in the HSTS header for your custom domain.
    2. If your domain in Salesforce includes a subdomain, complete the prerequisites for the related registrable domain.
        
        Examples of domains with a subdomain include https://www.example.com, https://shop.example.com, and https://shop.example.co.uk. In all three examples, the registrable domain is example.com.
        
        You can find the prerequisites on [https://hstspreload.org](https://hstspreload.org). To determine any steps required to qualify for HSTS preloading, use the form on that website. Salesforce can’t complete those prerequisites for you.
    
    If your custom domain is a registrable domain and the Allow HSTS preloading registration option is enabled on your domain, Salesforce adds the required HTTP header. Otherwise, Salesforce can’t complete the prerequisites for your domain.
2. To add your domain to the HSTS preload list, go to [https://hstspreload.org](https://hstspreload.org), verify your domain’s eligibility, and then submit your domain.
    
    When your registrable domain is on the HSTS preload list, browsers that check that list always use HTTPS to access your domain and its subdomains.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)
    
    Note A third party defines and manages the HSTS preload list and its prerequisites. Salesforce can’t add your domain to the list for you.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note HSTS preloading is enabled on all Salesforce and Visualforce pages, and for all system-managed domains for Experience Cloud sites and Salesforce Sites. The system-managed domain format for Experience Cloud sites is `MyDomainName.my.site.com` in orgs with enhanced domains and `ExperienceCloudSitesSubdomain.force.com` in orgs without enhanced domains. The system-managed domain format for Salesforce Sites is `MyDomainName.my.salesforce-sites.com` in orgs with enhanced domains and `SalesforceSitesSubdomain.force.com` in orgs without enhanced domains. No action is required to enable HSTS preloading on those domains.

#### See Also

- [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.")
- [Custom Domain Management](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_dom_detail.htm&release=264.0.0&type=5 "Keep your custom domain up to date with your business needs. Learn how to manage your domain during org migrations and certificate changes. Edit your domain’s configuration option, move to a different domain name, or enable HSTS preloading. And when you no longer need a custom domain, delete the domain and its custom URLs in Salesforce.")