HSTS: What It Is, What It Does, and How to Enable It

HSTS (HTTP Strict Transport Security) is a response header that instructs the browser to always connect to your domain over HTTPS, never plain HTTP. Once received, the browser caches that instruction for the period you specify and automatically rejects any unencrypted connection attempt — even if the user types http:// in the address bar.

This article explains exactly what problem HSTS solves, why it's more secure than a plain 301 redirect, and how to enable it on the most common web servers.

What Problem Does HSTS Solve?

When you configure an HTTP-to-HTTPS redirect, the browser first makes a plain HTTP request and then gets redirected. That first step — the unencrypted HTTP request — is the weak point. An attacker on the same network (think coffee shop or airport Wi-Fi) can intercept that request and keep the user on HTTP. This is called an SSL stripping attack.

HSTS eliminates that vulnerable first step. After the first successful HTTPS visit, the browser never attempts HTTP for that domain again during the max-age validity period. The redirect happens locally, before any network request leaves the device.

Anatomy of the HSTS Header

The header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Each parameter has a specific meaning:

• max-age: how many seconds the browser should remember the directive. One year (31536000) is the recommended value for production.
• includeSubDomains: extends protection to all subdomains. If you have blog.yourdomain.com or shop.yourdomain.com, they're covered too.
• preload: signals that the site wants to be included in browsers' hardcoded HSTS Preload List, providing protection even on the very first visit.

HSTS Preloading: Protection from the Very First Visit

The HSTS header only protects users after the first successful HTTPS visit. The HSTS Preload List solves that gap: Chrome, Firefox, Safari, and Edge ship with a list of domains baked directly into their source code. If your domain is on that list, the browser always uses HTTPS even if the user has never visited before.

To request inclusion, visit hstspreload.org. Requirements are:

• A valid SSL certificate.
• HTTP-to-HTTPS redirect on the root domain.
• HSTS header with at least one year max-age, includeSubDomains, and preload.
• All subdomains must also work over HTTPS.

Warning: preload list inclusion is very hard to reverse. If you ever need to serve plain HTTP again (unlikely but possible), you'll have to request manual removal and wait months for browsers to update. Only submit if you are certain your site will always run on HTTPS.

How to Enable HSTS on Apache

You need mod_headers enabled. Add the directive inside the <VirtualHost *:443> block or in your .htaccess file:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

Important: only add this header in the port 443 (HTTPS) block, not in the HTTP block. If added to the HTTP block, the browser might cache the directive before confirming the connection was encrypted.

Also ensure you have a permanent redirect from HTTP to HTTPS in the port 80 block:

<VirtualHost *:80>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

Reload Apache after the changes. Verify the header is present with curl -I https://yourdomain.com and look for the Strict-Transport-Security line in the output.

How to Enable HSTS on Nginx

Add the directive inside the server block for port 443:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # rest of your SSL configuration...
}

The port 80 block should redirect to HTTPS:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://yourdomain.com$request_uri;
}

Reload Nginx with nginx -s reload and confirm the header is present with curl -I.

Enabling HSTS in cPanel (Without SSH Access)

If your hosting runs cPanel and you don't have server access, you can enable HSTS directly from the panel:

1. Log in to cPanel and look for the Security section.
2. Click TLS Status or the HTTPS/SSL option depending on your panel version.
3. Some panels include an HSTS toggle in the Let's Encrypt or SSL/TLS interface.
4. Alternatively, edit your .htaccess file through the File Manager and add the Apache block shown above.

If your hosting plan doesn't allow HTTP header modification via .htaccess, contact technical support to request that mod_headers be enabled. For more on SSL security, browse our security articles.

HSTS Parameter Reference

Key takeaways

• HSTS instructs the browser to always use HTTPS, eliminating SSL stripping attacks that exploit the unencrypted first request.
• It complements a 301 redirect: the redirect handles the first visit; HSTS protects every subsequent one.
• Start with a low max-age (5 minutes) to catch problems before extending it to a full year.
• Only add preload if you are fully committed to HTTPS — removal from the preload list takes months.
• Only use includeSubDomains if every subdomain already has a valid SSL certificate.

Need help configuring HSTS and building a solid HTTPS environment for your site? The team at elenlace.com handles the full implementation and ongoing technical maintenance so you don't have to.

FAQ

Does HSTS work if my site still has pages on HTTP?

No. If you enable HSTS with includeSubDomains and any subdomain lacks an SSL certificate, users won't be able to access it at all. Before activating HSTS, confirm that every URL and subdomain on your site works correctly over HTTPS.

Can I reverse HSTS if I make a mistake?

Partially. You can remove the header from the server at any time, but browsers that already cached it will keep enforcing HTTPS until the max-age expires. If you submitted to the preload list, removal can take months. This is why it's recommended to start with a very short max-age and ramp up gradually.

Does HSTS replace an SSL certificate?

No. HSTS requires a valid SSL certificate to work. It's an additional security layer, not a substitute. Without a valid certificate, the HSTS header has no effect because the browser cannot establish the HTTPS connection in the first place.

How do I know HSTS is working correctly on my site?

Run curl -I https://yourdomain.com in a terminal and look for the Strict-Transport-Security line in the response. You can also open browser developer tools, go to the Network tab, load the site, and inspect the response headers of the main request.

Prefer it done for you? El Enlace handles hosting and professional web development.

Useful resources

Other providers and guides worth comparing:

• IONOS
• GoDaddy
• HostGator México