Fix guide · HTTPS · medium

HSTS not enabled

HSTS (HTTP Strict Transport Security) tells browsers to only ever use HTTPS for your site. Without it, a visit can start over plain HTTP, and someone on the same network (public Wi-Fi, a compromised router) can intercept that first request and keep the visitor on an unencrypted copy of your site.

Time to fix

5 minutes

Risk if ignored

Downgrade attacks on shared networks

Breaks anything?

Only if parts of the site are still HTTP-only

How to fix it

In the server block that listens on 443:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Then: sudo nginx -t && sudo systemctl reload nginx

In the <VirtualHost *:443> block (needs mod_headers):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Then: sudo a2enmod headers && sudo systemctl reload apache2

Dashboard → SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS):

Enable HSTS: on
Max Age: 12 months
Include subdomains: on
Preload: off (turn on later, once you are sure)

No server change needed; Cloudflare adds the header.

In web.config, inside <system.webServer> of the HTTPS site:

<httpProtocol>
  <customHeaders>
    <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
  </customHeaders>
</httpProtocol>

Add it to the HTTPS site only.

At the top of public_html/.htaccess:

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

Works on most shared hosts.

Unsure? Start with max-age=300 (five minutes), check nothing breaks, then raise it to a year.

Check your fix

Common mistakes

Sending the header on port 80 only. Browsers ignore HSTS received over HTTP.
Leaving out "always" on nginx, so error pages go out without it.
Turning on preload before every subdomain has HTTPS. Preload is hard to undo.