HSTS (HTTP Strict Transport Security) is a security mechanism: the website uses a header to instruct the visitor’s browser to open the page exclusively via an encrypted HTTPS connection for a specified period, even if the visitor enters a http:// address or clicks on an old link.

Why is this necessary?

An SSL certificate and HTTPS redirection do not, on their own, provide complete protection. If a visitor opens the page via HTTP, the initial request is sent unencrypted, and it is only the server’s response that redirects the connection to HTTPS. On a public Wi-Fi network, an attacker can intercept this initial request and redirect the visitor to a fake, unencrypted page (SSL stripping). HSTS closes this loophole: the browser switches to HTTPS before the request is even sent.

HSTS provides an additional layer of protection: if the certificate is invalid, the browser will not allow the visitor to bypass the warning and access the site anyway.

The structure of the header

Strict-Transport-Security: max-age=31536000; includeSubDomains

• max-age: the number of seconds for which the browser should remember the rule (31,536,000 seconds = 1 year).
• includeSubDomains: this rule also applies to all subdomains.
• preload: indicates that you wish to add the domain to the HSTS list built into web browsers (see below).

The browser only takes into account headers received via HTTPS; those sent via HTTP have no effect.

Enable

Apache or LiteSpeed (.htaccess):

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Nginx: in the HTTPSserver block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Cloudflare: if your domain is hosted behind Cloudflare, you can enable it on the SSL/TLS > Edge Certificates page under the HTTP Strict Transport Security (HSTS) section.

Once enabled, you can check whether the header is being sent by looking in your browser’s developer tools (Network tab, amongst the document response headers) or by running the command curl -sI https://pelda.hu | grep -i strict.

Phased roll-out

As the browser remembers the rule for the duration of the max-age, and this setting cannot be reversed by visitors, it is advisable to proceed step by step:

1. Check that all pages and resources are working correctly over HTTPS, without any mixed content.
2. Start with a short duration, for example max-age=300 (5 minutes), and without includeSubDomains.
3. If there are no problems for a few days, extend it to a week, then to a year.
4. The includeSubDomains setting should only be included if every subdomain (e.g. mail., teszt., internal systems) has a valid certificate.

HSTS preload

Browsers also contain a built-in list of domains that are opened via HTTPS from the very first visit. You can request inclusion on the hstspreload.org website if the header is sent with a max-age value of at least one year, along with the includeSubDomains and preload flags. Removal from the list can take months, so you should only choose this option if you are certain that all subdomains of the domain will remain permanently on HTTPS.