If multiple Strict-Transport-Security headers are set with different settings (e.g. different max-age values), how will the browser behave? Does the browser just follow one of them, or simply error out and discard all? Is this behaviour different across various browsers?

1 Answer 1


According to RFC 6797, 8.1, the browser must only process the first header:

If a UA receives more than one STS header field in an HTTP response message over secure transport, then the UA MUST process only the first such header field.

  • 4
    It should be noted that this is the standard and a standard-conformant client will behave this way, there is no guarantee that the browsers in the real world actually conform to the standard perfectly.
    – user163495
    Commented Feb 22, 2021 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .