How to Enable HSTS on Your Website for Maximum HTTPS Security

HSTS (HTTP Strict Transport Security) is a response header that instructs the browser to connect exclusively over HTTPS for a defined period, completely eliminating the possibility of an SSL-downgrade attack. Once active, the browser skips the HTTP request entirely and goes straight to HTTPS.

Why HSTS Matters Even If You Already Have a 301 Redirect

A 301 redirect from HTTP to HTTPS works, but it has a gap: the user's very first request always leaves over HTTP before being redirected. In that instant there is a window for an SSL stripping attack on compromised networks (public Wi-Fi, rogue proxies).

HSTS closes that window because the browser remembers that your domain only accepts HTTPS and blocks the HTTP request on the client side, before it ever hits the network. The first visit is still needed to receive the header, but from that point on the browser enforces the policy locally.

Learn how HSTS fits into a broader security strategy in our SSL security resource hub.

Prerequisites

• Your site must already serve content over HTTPS with a valid certificate before enabling HSTS. Enabling it without working HTTPS will lock out visitors.
• All page resources (images, scripts, fonts) must also load over HTTPS — no mixed content.
• If you have subdomains, make sure they also have active HTTPS before using the includeSubDomains directive.

How to Enable HSTS in Apache (.htaccess)

The most common approach on shared hosting with cPanel is to add the header in the .htaccess file at the root of your site:

# Enable the headers module (already active on most servers)
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Parameter breakdown:

Progressive rollout strategy: start with a short max-age (300 seconds = 5 minutes), verify everything works, then increase to 31536000.

How to Enable HSTS in Nginx

In the server block of your Nginx virtual host (or in /etc/nginx/conf.d/), add:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # rest of your configuration...
}

The always keyword is important: it ensures the header is sent even on error responses (4xx, 5xx), preventing an attacker from forcing an HTTP error to bypass the policy.

How to Enable HSTS from cPanel (No File Editing Required)

Some cPanel providers expose this option directly in the interface:

1. Log in to cPanel.
2. Go to Security → SSL/TLS Manager or search for HSTS in the cPanel search bar.
3. If your provider has the HSTS module enabled, you'll see a per-domain toggle.
4. Enable it and choose the duration (max-age) from the dropdown.

If the option isn't available, the .htaccess method above is the most straightforward alternative.

The Preload Directive: Extra Benefit, Permanent Commitment

Adding preload to the header and registering your domain at hstspreload.org gets your domain hardcoded into browsers' built-in "HTTPS-only" lists (Chrome, Firefox, Safari, Edge). This protects even a brand-new user's very first visit.

Important warning: preload list inclusion is hard to undo and can take months to propagate. Before enabling preload:

• Confirm that all your subdomains have valid HTTPS.
• Use a max-age of at least 31536000.
• Include includeSubDomains.
• Have a clear plan for what happens if you ever need to revert to HTTP (it's non-trivial).

Verifying That HSTS Is Active

Three quick ways to confirm:

• Browser DevTools: open DevTools → Network tab → click any response from your site → look for Strict-Transport-Security in the response headers.
• curl: run curl -I https://yourdomain.com and check the output.
• SSL Labs: the test at ssllabs.com/ssltest reports whether HSTS is present and scores it.

The team at elenlace.com can audit your site's HTTP security headers and make sure HSTS, CSP, and other headers are implemented correctly.

Key Takeaways

• HSTS closes the attack window that 301 redirects leave open on the very first HTTP request.
• Enable it only after confirming HTTPS works on the domain and all its subdomains.
• Start with a short max-age, verify, then increase to 31536000 (one year).
• Use includeSubDomains to protect your entire subdomain family.
• The preload directive offers maximum protection but is a long-term commitment — plan it carefully.

Want to implement HSTS and review all of your site's security headers at once? The team at elenlace.com runs the audit and delivers a concrete action plan.

FAQ

What happens if I enable HSTS but my SSL certificate expires?

Browsers will block access to your site and display a security error that users cannot easily bypass, since HSTS prevents manual exceptions. This is why automatic certificate renewal is critical before enabling HSTS with a long max-age.

Does HSTS affect SEO rankings?

Indirectly, in a positive way. Google uses HTTPS as a ranking factor, and a correctly configured HSTS header reinforces the trust signal. It also eliminates the HTTP→HTTPS redirect for repeat visitors, slightly improving load time.

Can I turn off HSTS if I change my mind?

Yes, but with limitations. You can remove the header from your server, but browsers that already received it will continue enforcing the policy until the max-age expires. To disable it sooner, serve the header with max-age=0 for the remaining period, signaling the browser to forget the policy. If you're on the preload list, the process is considerably slower.

Does HSTS protect against all SSL attacks?

No. It specifically protects against downgrade attacks (SSL stripping) and unwanted HTTP connections. It does not replace a valid certificate, strong ciphers (TLS 1.2/1.3), or other security headers like CSP and X-Frame-Options.

Compare providers

Other providers and guides worth comparing:

• IONOS
• GoDaddy
• HostGator México