Force HSTS using .htaccess

HSTS (HTTP Strict Transport Security) protects users from cookie hijacking and protocol downgrade attacks by forcing browsers to request HTTPS pages from your domain. HSTS is similar to a 301 redirect from HTTP to HTTPS but at the browser level.

There may be a specific HSTS configuration appropriate for your website. The following are less secure options and preload-ineligible as first-time traffic to your site will be able to use insecure HTTP:

Header Set Strict-Transport-Security: max-age=10886400;
Header Set Strict-Transport-Security: max-age=10886400; includeSubDomains

A breakdown of the header:

Below we’ll cover adding the most secure HSTS configuration using the .htaccess file and submitting your domain to the Chrome preload list maintained by Google.

Warning:Once enabled, HSTS disallows the user from overriding an invalid or self-signed certificate message. Your website will be inaccessible without a valid SSL.

Enable HSTS for Preloading

1. Using SSH or cPanel File Editor, edit your .htaccess file.
2. Add the following line to your .htaccess file:

   Header set Strict-Transport-Security "max-age=10886400; includeSubDomains; preload"

   Note: The expiry must be at least 18 weeks (10886400 seconds).

3. To submit your domain for preloading, visit HSTSpreload.org.
4. Type your domain and Check HSTS preload status and eligibility.
5. The background will turn green or red depending on the results.
6. Fix the errors and/or submit your domain for preloading.

After submitting your domain for HSTS preloading, it can take 2-6 months for your domain to be accepted and then listed in the latest browser versions. You can read more about the preload process at hstspreload.org and browsers supporting HSTS at CanIUse.com.