HSTS Header Configuration & SSL/TLS Enforcement Guide
Step-by-step instructions to configure HTTP Strict Transport Security (HSTS) headers across NGINX, Apache, IIS, and Cloudflare to prevent SSL stripping attacks.
⚡ Direct Answer & Quick Diagnostic Summary (AEO)
To configure HTTP Strict Transport Security (HSTS) and eliminate man-in-the-middle SSL-stripping vulnerabilities for web applications: Deploy the "Strict-Transport-Security" HTTP response header over HTTPS connections with a minimum duration of one year (max-age=31536000), including all subdomains ("includeSubDomains"), and enabling browser preloading ("preload"). On Pakistani public Wi-Fi networks (such as cafes, airports, and coworking spaces in Karachi, Lahore, and Islamabad), attackers frequently use tools like sslstrip or rogue access points to intercept initial plain HTTP requests and downgrade traffic to unencrypted HTTP before the 301/302 redirect completes. HSTS instructs modern web browsers (Chrome, Edge, Safari, Firefox) to strictly remember that a domain must ONLY be contacted via HTTPS, automatically upgrading all plain HTTP URLs locally on the user's device before any network packet is dispatched. Implementation requires adding a one-line directive in NGINX ("add_header Strict-Transport-Security ... always;"), Apache .htaccess ("Header always set Strict-Transport-Security ..."), IIS Custom HTTP Response Headers, or toggling Edge HSTS in Cloudflare SSL/TLS settings.
Primary Root Causes
Can't resolve this issue or hardware failure halted your shift?
Our certified field hardware & network engineers are on standby for emergency on-site repair across Korangi, SITE, Clifton, DHA, Shahrah-e-Faisal, and all Karachi commercial areas.
Step-by-Step Diagnostic Checklist
Step 1: Prerequisite Check: Ensure Valid SSL/TLS Certificate & 301 HTTPS Redirects
Before enabling HSTS, ensure that your primary apex domain and all subdomains have valid, trusted SSL/TLS certificates (Let's Encrypt, DigiCert, Cloudflare Origin CA). Verify that all port 80 HTTP requests permanently redirect to HTTPS via 301 redirects.
Step 2: Configure HSTS on NGINX Web Server
In your site configuration file (/etc/nginx/sites-available/yourdomain.conf), inside the HTTPS server block (listen 443 ssl;), add the directive: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; Test with nginx -t and reload via systemctl reload nginx.
Step 3: Configure HSTS on Apache HTTP Server (.htaccess)
Ensure mod_headers is enabled (sudo a2enmod headers). Inside your .htaccess or VirtualHost (<VirtualHost *:443>) configuration, add: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" and restart Apache.
Step 4: Configure HSTS on Microsoft Internet Information Services (IIS)
Open IIS Manager, select your site, and click "HTTP Response Headers". Click "Add" and enter Name: Strict-Transport-Security, Value: max-age=31536000; includeSubDomains; preload. Alternatively, in web.config inside <system.webServer><httpProtocol><customHeaders>, add <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" />.
Step 5: Enable HSTS in Cloudflare Edge (One-Click Setup)
If routing traffic through Cloudflare CDN, log into Cloudflare Dashboard -> SSL/TLS -> Edge Certificates. Scroll down to "HTTP Strict Transport Security (HSTS)" and click "Change HSTS settings". Toggle Enable HSTS to ON, set Max Age to 12 months (31,536,000 seconds), check "Apply HSTS policy to subdomains", and check "Preload". Click Save.
Step 6: Verify Response Headers & Submit to Chromium HSTS Preload List
Open terminal and run: curl -sI https://yourdomain.pk | grep -i strict-transport-security. Verify the header is present with max-age >= 31536000. Once verified across all subdomains, submit your domain to https://hstspreload.org to hardcode HTTPS enforcement into the source code of Chrome, Safari, Firefox, and Edge worldwide.
Frequently Asked Questions
Can enabling HSTS break subdomains that don't have SSL certificates?
Yes! If you specify includeSubDomains, browsers will refuse to connect to ANY subdomain (e.g. erp.yourdomain.pk, dev.yourdomain.pk, or cpanel.yourdomain.pk) over plain HTTP or if its SSL certificate is invalid/self-signed. Ensure every active subdomain has a valid certificate before adding includeSubDomains.
What happens if our SSL certificate expires while HSTS is active?
With HSTS active, browsers will completely block user access and REMOVE the "Proceed anyway (unsafe)" bypass link. This makes automated certificate renewal (via Certbot, cPanel AutoSSL, or Cloudflare Universal SSL) critical to avoid complete website lockout.
Why does curl or browser show HSTS header missing on HTTP port 80?
Per RFC 6797, web servers MUST NOT send the Strict-Transport-Security header over insecure HTTP connections. It must only be injected on secure HTTPS (port 443) responses. A server should simply 301-redirect HTTP to HTTPS, and then send HSTS on the HTTPS response.
Need Enterprise Deployment or Support for IT Support & IT Services?
If your team needs full hands-on setup, SLA monitoring, or emergency on-site assistance in Karachi, our certified engineers are ready.