No HSTS (Strict-Transport-Security) — how to enable it safely

What's wrong

Without the Strict-Transport-Security header a user's first request may go over HTTP, where it can be intercepted and rewritten (SSL stripping). HSTS tells the browser "HTTPS only for this site" for a set period.

How to enable

First make sure every host and subdomain you need works over HTTPS. Then roll out in steps:

# 1. a week — short max-age
add_header Strict-Transport-Security "max-age=86400" always;
# 2. all good — one year
add_header Strict-Transport-Security "max-age=31536000" always;
# 3. all subdomains on HTTPS — add includeSubDomains
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

• Send the header only from the HTTPS server block.
• always keeps it on 4xx/5xx responses too.
• In nginx an add_header inside a nested location drops the server-level headers — repeat it there.

Careful with preload

preload plus submitting to hstspreload.org bakes the domain into browsers; rolling back takes months. Only when you're sure about every subdomain.

Check it with HTTP Inspector, security headers section.