Strict-Transport-Security header
HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.
Recommended value
Strict-Transport-Security: max-age=31536000; includeSubDomainsWhat it protects against
SSL-stripping and downgrade attacks on public Wi-Fi, and accidental plain-HTTP requests that leak cookies.
Before you turn it on
Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.
How to add Strict-Transport-Security
Check your site's headers now
Korrali Web scans your site and shows which security headers are missing or misconfigured.
Run a free scan