AI Cyber Shield

How to add the HSTS header to your site

HSTS tells browsers to always use HTTPS on your site, even when someone types http or follows an old link. Without it, an attacker on a public network can downgrade a visitor to an unencrypted connection.

includeSubDomains and preload require every subdomain to work over HTTPS. If you are not sure, start without them and with a short max-age (for example 300), and raise it once you have checked.

How to fix it, by platform

WordPress

Where: your theme's functions.php (or a snippets plugin)

add_action('send_headers', function () {
  header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
});

WordPress sends the Strict-Transport-Security header on every page load.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Cloudflare

Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add

Set static  —  Header name: Strict-Transport-Security  —  Value: max-age=31536000; includeSubDomains; preload

Cloudflare injects the Strict-Transport-Security header at the edge, no server change needed.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Vercel / Next.js

Where: next.config.js → async headers()

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: [
      { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains; preload" },
    ]}];
  },
};

Next.js sets the Strict-Transport-Security header on every route.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Netlify

Where: a `_headers` file in your publish directory (or netlify.toml)

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Netlify applies the Strict-Transport-Security header to all paths (`/*`).

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Nginx

Where: nginx.conf — inside your `server { }` block, then reload nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Adds the Strict-Transport-Security header for every response.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Apache

Where: .htaccess (or the vhost config), then restart Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Adds the Strict-Transport-Security header via mod_headers.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

IIS

Where: web.config — inside <system.webServer><httpProtocol><customHeaders>

<add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" />

Adds the Strict-Transport-Security header in IIS.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Your web server

Where: your web server's response-header configuration

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Configure your server/CDN to send this header on all responses.

How to confirm: Reload the site and check the response headers include `Strict-Transport-Security`.

Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.

Scan your site free

Related guides