HSTS (HTTP Strict Transport Security)

What the HSTS header does, why missing HSTS is flagged as a security finding, and the exact Strict-Transport-Security header to add on nginx, Apache, and Cloudflare.

What it is

HSTS is an HTTP response header (Strict-Transport-Security) that tells browsers to only ever connect to your site over HTTPS — even if the user types http:// or clicks an old http link. Without it, a single insecure request can be intercepted.

Why it matters

Missing HSTS enables SSL-stripping attacks: an attacker on the network downgrades the connection to plain HTTP and reads or modifies traffic. It's also a grading factor in every security scanner and a PCI DSS expectation.

How to fix it

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Cloudflare

SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) → Enable

See if your site passes

Check your HSTS header free

FAQ

What max-age should I use?

Start with 300 seconds to test, then raise to 31536000 (1 year) once you're sure HTTPS works everywhere including subdomains.

What does preload do?

It opts your domain into browser preload lists so HSTS applies even on the very first visit. Only enable after testing — removal is slow.

More explainers: Content-Security-Policy (CSP) · DMARC (Domain-based Message Authentication) · Cookie Consent (GDPR/ePrivacy) · SPF (Sender Policy Framework) · DKIM (DomainKeys Identified Mail) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks