Is HTTP Public Key Pinning a strong defense you should deploy?

Is HTTP Public Key Pinning a strong defense you should deploy?

Older hardening guides still recommend "pin your public keys with HPKP for maximum security." Follow that advice and you will deploy a feature browsers removed. HPKP (HTTP Public Key Pinning, RFC 7469) let a site send a header committing browsers to accept only specific public keys for a set period. The intent was to stop misissued certificates from being usable against your domain.

In practice HPKP was a footgun with two failure modes. Hostage attacks: an attacker who briefly compromised a server could pin a key they controlled, locking out the legitimate owner for the pin's lifetime. Suicide: an operator who lost the pinned key, or failed to maintain a backup pin, bricked their own domain for every returning visitor — no recovery, no override. Chrome deprecated HPKP in 2018 and removed it; the broader ecosystem followed.

The properties HPKP aimed for are now served better by Certificate Transparency (detection of misissuance) and, for native apps where you control the client, application-level pinning with a managed update path.

— HPKP enabled hostage and suicide failures
— Browsers removed it in 2018
— CT plus app-level pinning replaced it

Further reading: RFC 7469; Chrome HPKP deprecation notice (2018).
Bottom line: Do not deploy HPKP — it no longer exists in browsers and was dangerous when it did. Rely on CT instead.