Secure Your Site with HTTP Strict Transport Security (HSTS)

In today’s digital landscape, securing your website is more than just a best practice—it’s essential. One powerful tool in your web security arsenal is HTTP Strict Transport Security (HSTS).

This policy ensures that browsers only connect to your site using secure HTTPS connections, protecting users from threats like protocol downgrade attacks and cookie hijacking.

This tutorial walks you through implementing HSTS on your website using the .htaccess file and submitting your domain to the HSTS preload list for maximum protection.

 

What is HSTS?

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with your site over HTTPS, even if users attempt to access it via HTTP.

Unlike a 301 redirect, which happens server-side, HSTS operates at the browser level—making it faster and more secure.

By implementing HSTS and submitting your domain for preloading, you’re taking a proactive step toward securing your website and protecting your users. It’s a simple yet powerful upgrade that every HTTPS-enabled site should consider.

Warning: Once enabled, HSTS disallows the user from overriding an invalid or self-signed certificate message. Your website will be inaccessible without a valid SSL.

 

Adding HSTS

To enable HSTS, you’ll need to modify your server’s root .htaccess file. Here’s how:

Add the following directive to the top of the file:

Header set Strict-Transport-Security “max-age=31536000; includeSubDomains; preload”

• max-age=31536000: Tells browsers to remember the HTTPS-only rule for one year (in seconds).
• includeSubDomains: Applies the rule to all subdomains.
• preload: Authorizes your domain for inclusion in browser preload lists.

Submit your domain to the Chrome HSTS preload list by visiting HSTSPreload.org. This ensures that major browsers like Chrome, Firefox, and Edge enforce HTTPS from the first visit.

After submitting your domain to HSTSPreload.org, it may take 2–6 months for your domain to be accepted and included in browser preload lists. You can track browser support for HSTS at CanIUse.com.

 

Verifying HSTS

Once you’ve added the header, test it using SecurityHeaders.com.

This tool checks for the presence and correctness of your HSTS configuration along with other security headers.

Additional Tips

• SSL Certificate Required: HSTS disables user overrides for invalid or self-signed certificates. Your site must have a valid SSL certificate.
• Preload Eligibility: To be eligible for preloading, your max-age must be at least 18 weeks (10886400 seconds), and the header must include both includeSubDomains and preload.
  • Example: Header set Strict-Transport-Security “max-age=10886400; includeSubDomains; preload”

Summary of HSTS Header Components

• Strict-Transport-Security: Activates HSTS policy for the domain.
• max-age: Duration (in seconds) for which HTTPS-only access is enforced.
• includeSubDomains: Extends the policy to all subdomains.
• preload: Requests inclusion in browser preload lists.

 

Less Secure Configurations

These options are not preload-eligible and allow initial HTTP access:

Header set Strict-Transport-Security “max-age=10886400;”

Header set Strict-Transport-Security “max-age=10886400; includeSubDomains”

 

Conclusion

I welcome your thoughts, questions or suggestions on my article on how to secure your website with HTTP Strict Transport Security (HSTS).

You may support my work by sending me a tip using your Brave browser or by sending me a one time donation using your credit card.

Let me know if you found any errors within my article or if I may further assist you by answering any additional questions you may have.