What is HSTS and How to Enable Strict-Transport-Security

What is HSTS?

HTTP Strict Transport Security (HSTS) is a web security policy sent as a response header. When a browser receives it, it remembers that this domain should only ever be contacted over HTTPS — for the duration of the max-age you specify.

Without HSTS, even a site that has a working HTTPS redirect is vulnerable during the first visit or after a browser cache clear. An attacker on the same network (coffee shop Wi-Fi, hotel, airport) can intercept that initial plain-HTTP request before the 301 redirect fires — a classic SSL stripping attack. HSTS closes that window entirely.

The header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age=31536000 — 1 year, the minimum required for HSTS preload submission.
includeSubDomains — enforces HTTPS on all subdomains (mail., api., etc.).
preload — opts into the browser preload list so HSTS applies even before the first connection.

Why it Matters

• ▶Prevents SSL stripping: Attackers can no longer downgrade your site from HTTPS to HTTP mid-connection.
• ▶Protects cookies and session tokens: Any cookies without the Secure flag are still safe because the browser will never make a plain HTTP request.
• ▶Compliance requirement: HSTS is required or recommended by PCI DSS, HIPAA guidance, and most government web standards (NIST SP 800-52, USGCB).
• ▶SEO signal: Google treats HTTPS as a ranking factor. A missing or misconfigured HSTS header can indicate insecure redirect chains.

How to Enable HSTS on Nginx

Add the header inside your server block that listens on port 443 (HTTPS):

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    # ... your SSL cert config ...

    add_header Strict-Transport-Security
        "max-age=31536000; includeSubDomains; preload"
        always;
}

The always keyword ensures the header is sent even on error responses (4xx, 5xx). After editing, reload nginx: sudo nginx -s reload.

How to Enable HSTS on Apache

First, enable the headers module if it isn’t already:

sudo a2enmod headers
sudo systemctl restart apache2

Then add the header in your VirtualHost block for port 443:

<VirtualHost *:443>
    ServerName example.com
    # ... SSL config ...

    Header always set Strict-Transport-Security         "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

If you use a .htaccess file, you can add it there instead — but VirtualHost-level configuration is preferred as it requires the Secure connection context.

How to Enable HSTS on Cloudflare

Cloudflare can inject the HSTS header at the edge, even if your origin server doesn’t set it:

1. Log in to the Cloudflare dashboard and select your domain.
2. Go to SSL/TLS → Edge Certificates.
3. Scroll to HTTP Strict Transport Security (HSTS) and click Enable HSTS.
4. Set Max Age Header to 12 months (recommended).
5. Toggle on Apply HSTS Policy to Subdomains and Preload if your subdomains are all HTTPS-ready.
6. Click Save.

Changes take effect within seconds via Cloudflare’s edge network. No server restart required.

How to Verify HSTS is Working

Use curl to inspect the response headers directly:

curl -sI https://example.com | grep -i strict

You should see output like:

strict-transport-security: max-age=31536000; includeSubDomains; preload

You can also check in Chrome DevTools: open the Network tab, click your domain’s request, and look for strict-transport-security in the Response Headers panel.

For preload submission, once your max-age is ≥31536000 and your site is 100% HTTPS, submit your domain at hstspreload.org. Preload list inclusion takes a few weeks and is included in Chrome, Firefox, Safari, and Edge releases.