<\/span>Subdomain Inclusion (Optional)<\/span><\/h3>\n\n\n\nIf your site has subdomains (like blog.example.com or store.example.com), you’ll want to consider whether to include them in your HSTS policy. Including subdomains means that browsers will also require HTTPS for those subdomains and will redirect any HTTP requests to the HTTPS version. This helps ensure consistent security across your entire domain. However, it also means those subdomains must use HTTPS as well for HSTS to function properly.<\/p>\n\n\n\n
Once you’ve checked off these prerequisites, you’re ready to start enforcing HSTS on your site. The next step is configuring your web server to send the Strict-Transport-Security header to user agents.<\/p>\n\n\n\n
<\/span>How to Enable HSTS in Your Web Server Configuration<\/span><\/h2>\n\n\n\nTo enable HSTS, you’ll need to configure your web server with a special header. This tells browsers that your site should only be accessed via HTTPS.<\/p>\n\n\n\n
<\/span>Apache Configuration<\/span><\/h3>\n\n\n\nIf you use the Apache web server, you’ll need to add a header to your site’s .htaccess file or virtual host configuration. Add this line:<\/p>\n\n\n\n
Header set Strict-Transport-Security \"max-age=31536000\"<\/code><\/code><\/pre>\n\n\n\nThis will tell browsers to use HTTPS for your site for the next year (31536000 seconds). You can adjust the max-age to your liking.<\/p>\n\n\n\n
<\/span>Nginx Configuration<\/span><\/h3>\n\n\n\nFor Nginx, add this to your server block:<\/p>\n\n\n\n
add_header Strict-Transport-Security \"max-age=31536000\";<\/code><\/code><\/pre>\n\n\n\nAgain, adjust the max-age as needed. This will add the HSTS header to all responses from that server block.<\/p>\n\n\n\n
<\/span>WordPress<\/span><\/h3>\n\n\n\nIf you use WordPress, you can add the HSTS header using a plugin like WordPress HTTPS (SSL). Activate the plugin, enter your HSTS max-age, and it will automatically add the header for you.<\/p>\n\n\n\n
<\/span>Testing Your Configuration<\/span><\/h3>\n\n\n\nTo test that HSTS is working properly, first clear your browser’s cache and cookies. Then, try to access your site via HTTP. If all is working, your browser will automatically redirect to the HTTPS version of the site. The HSTS header tells your browser that HTTP should not be used to access the site.<\/p>\n\n\n\n
Enabling HSTS hardens your site’s security by ensuring all communication is encrypted. It mitigates risks like cookie hijacking and man-in-the-middle attacks. For most sites, enabling HSTS is a simple step that provides substantial security benefits.<\/p>\n\n\n\n