KKorrali Web

Security headers › Strict-Transport-Security

How to add the Strict-Transport-Security header in Nginx

HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.

Nginx configuration (nginx server block)

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.

Verify it works

curl -sI https://your-site.com | grep -i strict-transport-security

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Nginx