How do I configure HTTP Strict Transport Security properly?
Asked on Sep 20, 2025
Answer
To configure HTTP Strict Transport Security (HSTS) properly, you need to set the `Strict-Transport-Security` header in your web server's response to enforce secure (HTTPS) connections.
<!-- BEGIN COPY / PASTE -->
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
<!-- END COPY / PASTE -->Additional Comment:
max-age=31536000sets the duration (in seconds) that the browser should remember that a site is only to be accessed using HTTPS. 31536000 seconds is equivalent to one year.includeSubDomainsensures that the rule applies to all subdomains as well, enhancing security across your entire domain.preloadis optional and indicates to browsers that your site should be included in the HSTS preload list, which requires submission to a browser-maintained list.
✅ Answered with Security best practices.
Recommended Links: