Guide · 3 min read
HSTS, step by step
HTTP Strict Transport Security tells browsers to only ever use HTTPS for your site, which stops downgrade and cookie-stealing attacks on public Wi-Fi. It’s sticky, so roll it out in stages.
Before you start
- Every page must work over HTTPS, and
http://must redirect tohttps://on the same host. - If you’ll use
includeSubDomains, every subdomain (mail, shop, staging) must have a valid certificate too.
Stage 1: five minutes
nginx
add_header Strict-Transport-Security "max-age=300" always;Stage 2: one year, with subdomains
nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;.htaccess
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"On Cloudflare: SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS).
Stage 3 (optional): preload
Preloading builds HSTS into browsers. hstspreload.org requires a max-age of at least one year, includeSubDomains and the preload token. Removal takes months, so only preload when you’re sure every subdomain will stay on HTTPS.
nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;