Skip to main content
Deployment

Configuring HSTS to Enforce HTTPS

Configure HTTP Strict Transport Security to require browsers to access your website over HTTPS.

CertOne1 min read

HTTP Strict Transport Security (HSTS) instructs browsers to use HTTPS and helps prevent downgrade attacks. This guide explains its configuration.

1. What is HSTS?​

1. Definition​

HSTS is an HTTP response header that tells browsers to use HTTPS for a specified period. Requests entered with HTTP are upgraded to HTTPS.

2. Purpose​

  • Prevent downgrade attacks
  • Enforce HTTPS
  • Improve website security

2. HSTS configuration​

1. NGINX configuration​

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

2. Apache configuration​

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

3. Parameters​

  • max-age=31536000: retain the policy for one year, expressed in seconds
  • includeSubDomains: apply the policy to all subdomains
  • preload: signal consent to inclusion in the HSTS preload list

3. HSTS preloading​

1. Submit to the preload list​

  1. Visit https://hstspreload.org/
  2. Enter your domain
  3. Check that it meets the requirements
  4. Submit the request

2. Preload requirements​

  • Include includeSubDomains
  • Include preload
  • Set max-age to at least 31536000 seconds (one year)
  • Ensure all subdomains support HTTPS

4. Best practices​

1. Configuration recommendations​

  • ✅ Choose an appropriate max-age
  • ✅ Include includeSubDomains when all subdomains are ready
  • ✅ Submit to the preload list after verifying readiness

2. Considerations​

  • ⚠️ HSTS can be difficult to reverse once enabled
  • ⚠️ Ensure all subdomains support HTTPS
  • ⚠️ Test the HSTS configuration

Conclusion​

Correctly configured HSTS enforces HTTPS in browsers and helps protect against downgrade attacks.