Enable HSTS (Strict-Transport-Security)

Transport · about 5 min

In plain words

HSTS tells browsers: "only ever talk to this site over HTTPS." Without it, the very first visit can be quietly downgraded to unencrypted HTTP on hostile Wi-Fi.

What can go wrong

Someone on the same network (café, hotel, airport) can intercept the first request and redirect or read it.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

# inside the server { } block
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache / .htaccess

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Cloudflare

Rules → Transform Rules → Modify Response Header
  Set static: Strict-Transport-Security = max-age=31536000; includeSubDomains

# Cloudflare Pages: add to public/_headers
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Vercel

// vercel.json
{ "headers": [ { "source": "/(.*)", "headers": [
  { "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }
] } ] }

Netlify

# public/_headers
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

WordPress

// functions.php (child theme) — or use your security plugin's "HTTP headers" setting
add_action('send_headers', function () {
  header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
});

Before you change anything: Only add includeSubDomains once EVERY subdomain works on HTTPS. Start with max-age=300 for a day, then raise to one year. Do not add "preload" until you are sure — it is hard to undo.

Check that it worked

Re-run the ProbeHunt check. Or open DevTools → Network → your page → Response Headers and look for strict-transport-security.

Re-run the free check

References

MDN: Strict-Transport-Security