Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Add the HSTS Header

Tell browsers to reach your site over HTTPS only, closing the first-request gap.

Difficulty
Easy
Impact
Medium
Time
15 min

Before

curl -sI https://example.com | grep -i strict-transport
(no output)

After

Strict-Transport-Security: max-age=31536000; includeSubDomains
Before and after code for: How to Add the HSTS Header

HTTP Strict Transport Security tells browsers to use HTTPS for your domain for a stated period, so a first plain-HTTP request cannot be intercepted before the redirect happens. It is one response header. Add it only once HTTPS works everywhere, because a browser that has seen it will refuse HTTP until the max-age expires.

Why it matters

Without HSTS, the very first request a visitor makes can be plain HTTP, and that is the request an attacker on the same network wants. Around 46% of audited sites do not send it.

How to fix it

  1. Confirm HTTPS is complete

    Every page, subdomain and asset must work over HTTPS first. HSTS makes this hard to undo.

  2. Start with a short max-age

    Begin at a few days while you verify nothing breaks, then raise it to a year (31536000).

  3. Add includeSubDomains deliberately

    It applies to every subdomain, including internal ones that may still be HTTP. Check before adding it.

  4. Consider preload last

    The preload directive plus submission to the browser preload list removes even the first request: and is genuinely difficult to reverse.

The code

Beforetext
curl -sI https://example.com | grep -i strict-transport
(no output)
Aftertext
Strict-Transport-Security: max-age=31536000; includeSubDomains

On your platform

WordPress

Set it in the server config or at the CDN, not in PHP, so it is present on static assets too.

Next.js

Add it in the headers() function, or at the proxy that terminates TLS.

Sources

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress