CURLOPT_HSTSWRITEFUNCTION(3)

💅 CURLOPT_HSTSWRITEFUNCTION(3) ✨

okay so bestie, welcome to the CURLOPT_HSTSWRITEFUNCTION page from the Library Functions Manual — yes, the libcurl one, and no, you can't skip it, this is the good stuff 🎀

---

🌸 NAME 🌸

CURLOPT_HSTSWRITEFUNCTION — the write callback for HSTS hosts, aka the little function that lets you save the HSTS cache before libcurl yeets it into the void 💀

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

struct curl_hstsentry {
  char *name;
  size_t namelen;
  unsigned int includeSubDomains:1;
  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
};

struct curl_index {
  size_t index; /* the provided entry's "index" or count */
  size_t total; /* total number of entries to save */
};

CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *sts,
                      struct curl_index *count, void *clientp);

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSWRITEFUNCTION, hstswrite);

---

🦋 DESCRIPTION 🦋

Pass a pointer to your callback function, exactly like the prototype up there shows ⬆️. That's the whole assignment, no cap.

This callback gets called by libcurl repeatedly — like, over and over — so your app can store the in-memory HSTS cache when libcurl is about to discard it 🗑️. It's giving "last chance to save your work" energy fr fr.

Set the clientp argument with the CURLOPT_HSTSWRITEDATA(3) option, or just let it be NULL, whatever works 🫶. When the callback is invoked, the sts pointer points to a populated struct, so here's the tea:

• Read the hostname from name — it is namelen bytes long and null terminated 👑
• The includeSubDomains field is non-zero if the entry matches subdomains 🌈
• The expire string is a date stamp, null-terminated, using the syntax YYYYMMDD HH:MM:SS ⏰

Your callback should return CURLSTS_OK if it succeeded and is prepared to be called again (for another host), or CURLSTS_DONE if there is nothing more to do 🎀. It can also return CURLSTS_FAIL to signal error 😭.

heads up bestie!! 🚨 This option does not enable HSTS. You need to use CURLOPT_HSTS_CTRL(3) to do that. Don't come for me, I'm just the messenger 💅

---

💜 DEFAULT 💜

NULL — no callback. literally nothing happens, it's a vibe, it's fine 🙈

---

🌸 PROTOCOLS 🌸

This functionality affects http only 🧚

---

⭐ EXAMPLE ⭐

struct priv {
  void *custom;
};

static CURLSTScode hswr_cb(CURL *easy, struct curl_hstsentry *sts,
                           struct curl_index *count, void *clientp)
{
  /* save the passed in HSTS data somewhere */
  return CURLSTS_OK;
}

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    struct priv my_stuff;
    CURLcode result;

    /* set HSTS read callback */
    curl_easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hswr_cb);

    /* pass in suitable argument to the callback */
    curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, &my_stuff);

    result = curl_easy_perform(curl);
  }
}

(and yes, the comment in the example really does say "set HSTS read callback" even though this is the write callback — we love a chaotic comment, iykyk 😭 keep it exactly as is)

---

🔥 AVAILABILITY 🔥

Added in curl 7.74.0 — so if your curl is older than that, this option simply doesn't exist, bestie 🕰️

---

💖 RETURN VALUE 💖

This returns CURLE_OK ✨

---

👑 SEE ALSO 👑

• CURLOPT_HSTS(3)
• CURLOPT_HSTSWRITEDATA(3)
• CURLOPT_HSTSWRITEFUNCTION(3)
• CURLOPT_HSTS_CTRL(3)

(and yes, this page links to itself in SEE ALSO — iconic self-referential main character energy, don't question it 💅)

---

and that's the whole page, bestie!! 🎀 this came to you from the libcurl manual, dated 2026-10-12, version line libcurl — so go forth and write that HSTS callback, slay, periodt 🦋💜