Ask any question about Website Security here... and get an instant response.

How do I configure HTTP Strict Transport Security properly?

Asked on Sep 20, 2025

Answer

To configure HTTP Strict Transport Security (HSTS) properly, you need to set the `Strict-Transport-Security` header in your web server's response to enforce secure (HTTPS) connections.

<!-- BEGIN COPY / PASTE -->
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    <!-- END COPY / PASTE -->

Additional Comment:

max-age=31536000 sets the duration (in seconds) that the browser should remember that a site is only to be accessed using HTTPS. 31536000 seconds is equivalent to one year.
includeSubDomains ensures that the rule applies to all subdomains as well, enhancing security across your entire domain.
preload is optional and indicates to browsers that your site should be included in the HSTS preload list, which requires submission to a browser-maintained list.

✅ Answered with Security best practices.

Ask any question about Website Security here... and get an instant response.

How do I configure HTTP Strict Transport Security properly?

Asked on Sep 20, 2025

Answer

Additional Comment:

The Q&A Network