--- layout: default ---
Security Policy

Strict-Transport-Security

IANA permanent response RFC 6797 reached by regulation 2 spellings

Declared by 35 providers across 3549 published specification files in the APIs.io network.

What this header is for, and how to use it →

A count here is providers whose published contract declares this header — not providers who send it. Response headers set at the edge rarely appear in an OpenAPI at all, so a low number can measure documentation practice rather than deployment.

Spelled 2 ways

HTTP field names are case-insensitive (RFC 9110 §5.1), so every spelling below is the same header on the wire. A contract is not the wire: generated clients key off the string, and a developer reading two of these sees two different headers.

Strict-Transport-Securitystrict-transport-security

Reached by regulation

Basis: evidentiary. No law names this header; it is the deployed control for an obligation that regulation does impose. Observable at the edge, without credentials.

hipaa glba nis2 osfi-guideline-b13 apra-prudential-standards nhs-dspt

The registry

Statuspermanent
ReferenceRFC 6797: HTTP Strict Transport Security (HSTS)

Providers declaring it (35)

aib-group-uk aldermore bank-of-ireland-uk bank-of-scotland barclays co-operative-bank coventry-building-society coveo first-direct gb-bank halifax leeds-building-society lemlist listrak lloyds-banking-group metro-bank mettle monument-bank nationwide-building-society open-banking-uk optus paragon-bank principality-building-society recognise-bank salesforce santander-uk secure-trust-bank shawbrook-bank shyft skipton-building-society starling-bank tsb-bank usertesting virgin-money-uk weatherbys-bank

Explore

All headers Security Policy Guidance on headers.apievangelist.com

Work with this as data

Every header here is available over the APIs.io API and to AI agents over MCP. HTTP Headers is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for http headers

3 MCP tools reach this
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
Search the catalog 
curl "https://apis.io/api/v1/search?q=strict-transport-security&limit=10"
Everything under a tag 
curl "https://apis.io/api/v1/tags/strict-transport-security"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.