HSTS (HTTP Strict Transport Security) setup for website

HSTS (HTTP Strict Transport Security) Setup for Websites

HSTS — mechanism where browser remembers site is available only via HTTPS and no longer tries HTTP connection. Single header in server configuration eliminates entire class of SSL stripping attacks.

How It Works

Server returns header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

After first visit browser caches this directive for 365 days. All subsequent requests to domain and subdomains automatically redirect to HTTPS before sending to network — without 301 redirect, without round-trip to server.

Nginx Setup

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Rest of configuration...
}

always parameter is critical — without it header won't be sent on error responses (4xx, 5xx).

Apache Setup

<VirtualHost *:443>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

mod_headers module must be enabled: a2enmod headers.

Gradual Rollout

Sharp HSTS activation with max-age=31536000 on production site — risky. If later SSL certificate doesn't cover some subdomain, users can't access it for months.

Recommended Order:

1. Verify all subdomains work via HTTPS
2. Configure automatic certificate renewal (Let's Encrypt + Certbot or similar)
3. Set max-age=300 (5 minutes), test for a week
4. Increase to max-age=2592000 (30 days)
5. Set max-age=31536000; includeSubDomains
6. Submit application to HSTS Preload List

HSTS Preload List

Application submitted to hstspreload.org. After inclusion browsers Chrome, Firefox, Safari know about your HSTS requirement before first user visit. Removing domain from list — long process (several months), so only domains with stable HTTPS infrastructure are included.

Preload Requirements:

• max-age at least 31536000
• includeSubDomains directive
• preload directive
• All subdomains must support HTTPS

Implementation Timeline

Basic header setup — 1–2 hours including testing. Full cycle to preload status — 2–4 weeks including gradual max-age increase.