Fix Guide

How to Enable HSTS (Strict-Transport-Security)

Force browsers to always use HTTPS for your site, closing the SSL-stripping window.

Medium High Impact 15 min

Why It Matters

Even with an HTTPS redirect, the very first request can go over HTTP before the redirect fires — a window for SSL-stripping attacks. HSTS tells the browser to use HTTPS for your domain from then on, removing that window entirely.

How to Fix

Confirm HTTPS is solid first

HSTS is sticky — only enable it once HTTPS works on the apex and all subdomains, or you can lock users out.

Send the header

Add Strict-Transport-Security with a long max-age, then increase it and consider preload.

Code Fix

http

Before (broken)

# No Strict-Transport-Security header

After (fixed)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Platform-Specific Instructions

WordPress

Add the header in your host's panel, .htaccess, or a security plugin (e.g., "Really Simple SSL" Pro).

Next.js

Add it under headers() in next.config.js, or at the CDN.

Check with our tool

HTTP Header Checker

Want to find all issues at once?

Run a free audit and get a prioritized fix list with auto-generated code.

Run a free audit

How to Enable HSTS (Strict-Transport-Security) — Fix Guide | SlapMyWeb