x

How do I set "Strict Transport Security" to my site?

I would like to add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload" to Apache .htaccess file. how do I make it or is there other option?

My site already uses SSL. 

Tags (1)
1,965 Views
Message 1 of 4
Report
3 REPLIES 3
Square

Thanks for joining the Community and making your first post, @Wuser1.

Unfortunately, there isn't a way to add that as we don't provide direct access to the .htaccess file for your site.

1,945 Views
Message 5 of 4
Report

Thank you Adam

I see, I hope we make it someday. 

1,936 Views
Message 5 of 4
Report

Is there an update to the HSTS issue?

Website Does Not Implement HSTS Best Practices medium severity -3.7 score impact
(Your score will increase upon approval of resolution)
Description

HTTP Strict Transport Security is an HTTP header that instructs clients (e.g., web browsers) to only connect to a website over encrypted HTTPS connections. Clients that respect this header will automatically upgrade all connection attempts from HTTP to HTTPS. After a client receives the HSTS header upon its first website visit, future connections to that website are protected against Man-in-the-Middle attacks that attempt to downgrade to an unencrypted HTTP connection. The browser will expire the HTTP Strict Transport Security header after the number of seconds configured in the max-age attribute.

665 Views
Message 5 of 4
Report
This thread has been archived and locked. Please start a new thread if you would like to continue the conversation.