KKorrali Web

Security headers › Strict-Transport-Security

How to add the Strict-Transport-Security header in Apache

HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Before you deploy

Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.

Verify it works

curl -sI https://your-site.com | grep -i strict-transport-security

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Apache