KKorrali Web

Security headers › Strict-Transport-Security

How to add the Strict-Transport-Security header in Cloudflare

HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.

Cloudflare configuration (Transform Rules)

Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: Strict-Transport-Security
Value: max-age=31536000; includeSubDomains

Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.

Before you deploy

Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.

Verify it works

curl -sI https://your-site.com | grep -i strict-transport-security

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Cloudflare