How to Set Up HSTS on Your Website (Nginx, Apache, Cloudflare)

HSTS (HTTP Strict Transport Security) is a header that tells browsers to only ever connect to your site over HTTPS. Once a browser sees it, it refuses plain HTTP for your domain for the duration of max-age — closing the window for downgrade and cookie-hijacking attacks.

The header

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age=31536000 — one year, in seconds.
• includeSubDomains — apply to every subdomain.
• preload — opt into the browser preload list (only add when you are ready).

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Cloudflare

SSL/TLS → Edge Certificates → enable HSTS and set max-age to 12 months.

Preloading

Once HSTS is live and stable, submit your domain at hstspreload.org. Warning: removal is slow, so confirm every subdomain serves HTTPS first.