KKorrali Web

Security headers › Strict-Transport-Security

How to add the Strict-Transport-Security header in Netlify

HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.

Netlify configuration (_headers file)

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

Before you deploy

Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.

Verify it works

curl -sI https://your-site.com | grep -i strict-transport-security

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Netlify