---
title: "Add HSTS in Drupal 8 with the Security Kit Module"
description: "Adding HSTS (HTTP Strict Transport Security) in Drupal 8 forces web browsers to only load your website with a valid SSL certificate. This improves Drupal security against downgrade attacks and..."
url: https://www.inmotionhosting.com/support/edu/drupal/hsts-drupal-8-security-kit/
date: 2019-12-03
modified: 2023-09-14
author: "InMotion Hosting Contributor"
categories: ["Drupal"]
type: post
lang: en
---

# Add HSTS in Drupal 8 with the Security Kit Module

Adding [HSTS (HTTP Strict Transport Security)](https://www.inmotionhosting.com/support/website/force-hsts-using-htaccess/) in Drupal 8 forces web browsers to only load your website with a valid SSL certificate. This improves Drupal security against downgrade attacks and similar man-in-the-middle (MITM) attacks. HSTS is similar to a [HTTP to HTTPS redirect](https://www.inmotionhosting.com/support/website/ssl/how-to-force-https-using-the-htaccess-file/) but within the browser.

Below we’ll cover how to install the [Security Kit module](#install) and [enable HSTS](#hsts).

**Warning:** Once enabled, HSTS disallows the user from overriding an [invalid or self-signed certificate message](https://www.inmotionhosting.com/support/website/ssl/self-signed-ssl-certificate-warning/). Your website will be inaccessible without a [valid SSL](https://www.inmotionhosting.com/support/amp/how-do-i-obtain-an-ssl-certificate/).

## Install Security Kit

1. [Login to Drupal](https://www.inmotionhosting.com/support/edu/drupal/how-to-log-into-the-drupal-admin-dashboard/).
2. [Install the Drupal module](https://www.inmotionhosting.com/support/edu/drupal/install-2/#admin) using the [Security Kit download link](https://www.drupal.org/project/seckit).
3. Click **Install** at the bottom.
4. Click **Configuration** at the top.

## Enable HSTS

1. Under *System*, Click **Security Kit settings**.
2. Click **SSL/TLS** to see HSTS settings.
3. Check the box for **HTTP Strict Transport Security**.
4. Specify the **Max-age** (in seconds) for how long the header should remain active.
5. (Optional) Check the box to **Include Subdomains** for this domain.
6. (Optional) Check **Preload** if you plan to [submit your domain to the HSTS preload list](https://www.inmotionhosting.com/support/website/force-hsts-using-htaccess/#preload) after saving these changes.
7. At the bottom, click **Save configuration**.

![HSTS with Security Kit](https://support-mkt.cloud.imhwebdev.net/support/wp-content/uploads/2019/12/drupal-security-kit-hsts.png)*Use the checkboxes to easily configure HSTS or click the clicks to learn more*

Get high performance and security with our [Managed Drupal Hosting](https://www.inmotionhosting.com/drupal-hosting).