How to add the HSTS header
HSTS tells browsers to only ever use HTTPS for your site, which stops downgrade attacks.
Why it matters
Without HSTS, the first visit on public Wi-Fi can be quietly switched to plain HTTP, letting someone on the same network read or change what the visitor sees. With it, browsers refuse to connect insecurely at all.
Steps
- Confirm every page and subdomain already works over HTTPS.
- Add the Strict-Transport-Security header at your host or CDN.
- Start with a short max-age such as 300 seconds and check the site still loads.
- Raise it to 31536000 (one year) once you are confident.
For your developer
Strict-Transport-Security: max-age=31536000; includeSubDomains
Check it worked
Open your browser's developer tools, reload the page, and look for strict-transport-security in the response headers of the main document. A rescan will mark the check as passed.
Not sure if this affects your site?
Run a free scan to see exactly which of these your website needs.