Online security has become a paramount concern for any organization that maintains a web presence. One of the most important protective measures is the Strict-Transport-Security header, also referred to as HSTS. This HTTP response header ensures that browsers access a site only over a secure connection.
Strict-Transport-Security is an HTTP response header that instructs the browser to use HTTPS exclusively when connecting to a given domain. Instead of relying solely on a simple HTTP-to-HTTPS redirection, which can be intercepted by attackers, Strict-Transport-Security removes the window of opportunity for malicious activities by ensuring the browser will automatically upgrade connections from HTTP to HTTPS for that domain.
Designates how many seconds this rule should remain active. Setting it to 31536000 (1 year) ensures long-term protection.
Ensures that all subdomains under your main domain follow the same security policy.
Hard-codes your domain's HTTPS-only rule in major browsers, even before first visit.
Attackers can intercept initial unencrypted requests and redirect users to malicious websites.
Attackers can intercept session cookies over HTTP connections and hijack user sessions.
Malicious actors can create deceptive pages that appear legitimate without HTTPS indicators.
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>a2enmod headersserver {
listen 443 ssl;
server_name yourdomain.com;
ssl_certificate /path/to/your.crt;
ssl_certificate_key /path/to/your.key;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
}nginx -t<configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security"
value="max-age=31536000; includeSubDomains; preload" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>Adopting Strict-Transport-Security significantly enhances your site's defense against various attack vectors. By instructing browsers to strictly use HTTPS, you eliminate the risk posed by insecure initial connections and ensure a consistent, encrypted experience for all users.
When you're confident your domain (and all its subdomains) can function solely over secure connections, consider submitting your site to the HSTS preload list. This proactive step ensures that major browsers refuse to connect to your domain using anything but HTTPS, right out of the box.
Learn about other HTTP security headers to strengthen your website's security: