How to enable HTTP Strict Transport Security (HSTS)?
Jul 12, 2025 am 01:00 AM
The method to enable HSTS is to configure the Strict-Transport-Security response header in the HTTPS website. The specific operations are: 1. Nginx adds the add_header directive in the server block; 2. Apache adds the header directive in the configuration file or .htaccess; 3. IIS adds customHeaders in web.config; make sure that the site fully supports HTTPS, parameters include max-age (valid period), includeSubDomains (subdomains are effective), preload (preload list), and submits to the HSTS Preload list. The prerequisites include the root domain name and the subdomain name support HTTPS, have a valid certificate, and the root path returns 200 responses. You can use the browser developer tools and SSL Labs Test. Or the curl command tests whether it is effective.
Enabling HTTP Strict Transmission Security (HSTS) is actually to configure a response header on your HTTPS website, telling the browser that you must use HTTPS to access this website in the future and cannot use plain text HTTP. The advantage of this is to prevent SSL stripping attacks, force encryption of connections, and improve security.
Let’s talk about how to correctly enable HSTS in different scenarios.
How to configure HSTS in a web server?
Mainstream web servers support adding HSTS response headers, the key is to add them to the response:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
The specific operations are as follows:
- Nginx : Add:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
- Apache : Added in virtual host configuration or
.htaccess:Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
- IIS : Add in the system.webServer paragraph of the web.config file:
<httpProtocol> <customHeaders> <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" /> </customHeaders> </httpProtocol>
Note: Make sure your site has fully supported HTTPS before configuration, otherwise it may be inaccessible after opening.
The role of each parameter in the HSTS header field
-
max-age: Specifies the time (in seconds) for the browser to force HTTPS, for example, 31536000 seconds is one year. -
includeSubDomains: Indicates that the policy applies to all subdomains. -
preload: allows you to submit domain names to the browser's built-in HSTS preload list, so that the user also forces HTTPS when the first visit.
If you just want to test first, you can temporarily not add preload and add it after confirming that there is no problem. Once submitted to the preloaded list, it cannot be easily withdrawn.
What should I pay attention to when submitting to the HSTS Preload list?
If you want your domain name to be loaded in HTTPS by default by mainstream browsers, you have to submit your application at http://ipnx.cn/link/ef96003dff3714cf3720aee9b14503b7 .
Prerequisites include:
- The root domain and all subdomains must support HTTPS
- A valid certificate must be
- A response of 200 must be returned in the root path (for verification)
- The HSTS response header has been set correctly, including
includeSubDomainsandpreload
After submitting, you need to wait for a while before you can be added to the preload list of browsers such as Chrome and Firefox.
Test whether HSTS is effective
You can check whether the settings are successful by:
- Using the browser developer tool (F12), check whether there is
Strict-Transport-Securityin the response header - Check your website security configuration with online tools such as SSL Labs Test
- Try to view the response header with the curl command:
curl -I http://yourdomain.com
If you see the HSTS header and the value meets expectations, it means that the configuration is in effect.
Basically that's it. Configuring HSTS is not complicated, but it is easy to ignore details, such as adding preload by mistake or not overwriting the subdomain name, so it is recommended to do it step by step, test it first and then go online.
The above is the detailed content of How to enable HTTP Strict Transport Security (HSTS)?. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
How to use Nginx Proxy Manager to implement automatic jump from HTTP to HTTPS
Sep 26, 2023 am 11:19 AM
How to use NginxProxyManager to implement automatic jump from HTTP to HTTPS. With the development of the Internet, more and more websites are beginning to use the HTTPS protocol to encrypt data transmission to improve data security and user privacy protection. Since the HTTPS protocol requires the support of an SSL certificate, certain technical support is required when deploying the HTTPS protocol. Nginx is a powerful and commonly used HTTP server and reverse proxy server, and NginxProxy
How to use Nginx Proxy Manager to implement reverse proxy under HTTPS protocol
Sep 26, 2023 am 08:40 AM
How to use NginxProxyManager to implement reverse proxy under HTTPS protocol. In recent years, with the popularity of the Internet and the diversification of application scenarios, the access methods of websites and applications have become more and more complex. In order to improve website access efficiency and security, many websites have begun to use reverse proxies to handle user requests. The reverse proxy for the HTTPS protocol plays an important role in protecting user privacy and ensuring communication security. This article will introduce how to use NginxProxy
Nginx with SSL: Configure HTTPS to protect your web server
Jun 09, 2023 pm 09:24 PM
Nginx is a high-performance web server software and a powerful reverse proxy server and load balancer. With the rapid development of the Internet, more and more websites are beginning to use the SSL protocol to protect sensitive user data, and Nginx also provides powerful SSL support, making the security performance of the web server even further. This article will introduce how to configure Nginx to support the SSL protocol and protect the security performance of the web server. What is SSL protocol? SSL (SecureSocket
How to configure https in tomcat
Jan 05, 2024 pm 05:15 PM
Configuration steps: 1. Obtain the SSL certificate; 2. Configure the SSL certificate; 3. Edit the Tomcat configuration file; 4. Restart Tomcat. Detailed introduction: 1. You need to obtain an SSL certificate, either a self-signed certificate or a valid SSL certificate from a certification agency (such as Let's Encrypt); 2. Place the obtained SSL certificate and private key files on the server and ensure that these files Located in a safe location, only users with sufficient permissions can access; 3. Edit Tomcat configuration files, etc.
Solution: urllib3 ProxySchemeUnknown(proxy.scheme)
Feb 29, 2024 pm 07:01 PM
The reason for the error is that the ProxySchemeUnknown(proxy.scheme) error of urllib3 is usually caused by the use of an unsupported proxy protocol. In this case, urllib3 does not recognize the proxy server's protocol type and therefore cannot use the proxy for network connections. To resolve this issue, you need to ensure that you are using a supported proxy protocol, such as HTTP or https. How to resolve To resolve this issue, you need to ensure that you are using a supported proxy protocol, such as HTTP or HTTPS. You can solve this problem by setting the proxy parameters of urllib3. If you are using an http proxy, the code example is as follows: importurllib3http
How to set up a secure HTTPS connection for a PHP form?
Aug 17, 2023 pm 03:25 PM
How to set up a secure HTTPS connection for a PHP form? As the Internet develops, security becomes more and more important in web development. The encrypted transmission protocol HTTPS plays a key role in protecting data transmission. When using PHP forms for data transmission, we can take some measures to ensure the security of the connection. This article will guide you on how to set up a secure HTTPS connection for PHP forms, with some code examples. Purchase an SSL Certificate First, you need to purchase an SSL Certificate. SSL certificate is a guaranteed website
Using HTTPS for data transmission in Java API development
Jun 18, 2023 pm 10:43 PM
With the development of science and technology, network communication has become one of the important tools for information transmission in modern society. But at the same time, information transmission on the network faces the risk of malicious attacks and theft, so security is particularly important. Based on this, the HTTPS protocol came into being. It is a protocol that adds SSL/TLS encryption to the HTTP protocol to ensure network transmission security. As a language widely used in network development, Java naturally provides a rich API to support the HTTPS protocol. This article will
What does the https workflow look like?
Apr 07, 2024 am 09:27 AM
The https workflow includes steps such as client-initiated request, server response, SSL/TLS handshake, data transmission, and client-side rendering. Through these steps, the security and integrity of data during transmission can be ensured.
