{"id":4685,"date":"2018-09-26T20:15:36","date_gmt":"2018-09-26T20:15:36","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2018\/09\/26\/force-hsts-using-htaccess\/"},"modified":"2021-08-16T22:24:34","modified_gmt":"2021-08-17T02:24:34","slug":"force-hsts-using-htaccess","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/website\/force-hsts-using-htaccess\/","title":{"rendered":"Force HSTS using .htaccess"},"content":{"rendered":"

HSTS (HTTP Strict Transport Security) protects users from cookie hijacking and protocol downgrade attacks by forcing browsers to request HTTPS pages from your domain. HSTS is similar to a 301 redirect<\/a> from HTTP to HTTPS but at the browser level.<\/p>\n\n\n\n

There may be a specific HSTS configuration appropriate for your website. The following are less secure options and preload-ineligible<\/strong> as first-time traffic to your site will be able to use insecure HTTP:<\/p>\n\n\n\n

Header Set Strict-Transport-Security: max-age=10886400;\nHeader Set Strict-Transport-Security: max-age=10886400; includeSubDomains<\/code><\/pre>\n\n\n
A breakdown of the header:<\/p>\n\n\n\n\n\n\n
Strict-Transport-Security<\/td>\nForces HSTS on the domain<\/td>\n<\/tr>\n
max-age<\/td>\nHow long the header should be active in seconds<\/td>\n<\/tr>\n
includeSubDomains<\/td>\nIncludes subdomains<\/td>\n<\/tr>\n
preload<\/td>\nAuthorizes preload listing if eligible (covered below)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/p>\n
Below we\u2019ll cover adding the most secure HSTS configuration<\/strong> using the .htaccess file and submitting your domain to the Chrome preload list<\/a> maintained by Google.<\/p>\n
Warning:<\/strong>Once enabled, HSTS disallows the user from overriding an invalid or self-signed certificate message<\/a>. Your website will be inaccessible without a valid SSL<\/a>.<\/p>\n
Enable HSTS for Preloading<\/h2>\n
    \n
  1. Using SSH<\/a> or cPanel File Editor<\/a>, edit your .htaccess file<\/a>.<\/li>\n
  2. Add the following line to your .htaccess file:\n
    Header set Strict-Transport-Security \"max-age=10886400; includeSubDomains; preload\"<\/pre>\n
    Note:<\/strong> The expiry must be at least 18 weeks (10886400 seconds<\/a>).<\/p>\n<\/li>\n
  3. To submit your domain for preloading, visit HSTSpreload.org<\/a>.<\/li>\n
  4. Type your domain and Check HSTS preload status and eligibility<\/strong>.<\/li>\n
  5. The background will turn green or red depending on the results.<\/li>\n
  6. Fix the errors and\/or submit your domain for preloading.<\/li>\n<\/ol>\n\n\n