Should I activate HSTS with Let’s Encrypt Certificates?

Yes, you should activate HSTS.

HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect to your website over SSL after their very first visit (trust-on-first-use) and until the specified timeout is reached.

The choice whether to activate HSTS or not doesn't really depend on which CA you're using rather than if you are sure you will continue to support HTTPS in the future. That is, as soon as you disable HTTPS again, any user whose HSTS timeout hasn't expired yet will be unable to connect to your site. If you are unsure about how long you will keep SSL support, you might want to start with short HSTS expiry times to avoid locking out your visitors for too long.


Don't confuse HSTS with HPKP: A HTTP Public Key Pinning header tells the browser to associate a specific public key with your site. Here, pinning for the wrong or expired certificates can make your site unavailable to previous users. But for HSTS, the particular certificate chain doesn't matter and you can change it as needed.


You can use HSTS as long as you're going to keep using HTTPS on your site. The specific certificate can change, but that is acceptable for HSTS.

If you use HTTP key pinning, you can require that the SSL key comes from a specific CA - in this case, Let's Encrypt - which might cause issues if you changed CA, but the certificate itself can change.

If you implemented a custom pinning method, which looked at specific certificate being used, then you'd have issues. That's not how the standard headers work though.

In short, should be fine with the certificate changing regularly - that's expected behaviour.