Add the Strict-Transport-Security (HSTS) header on Cloudflare

Why it matters

Without HSTS, a browser that is sent to the http:// address first can be intercepted before it reaches the secure site. The header tells browsers to use HTTPS only, for as long as you specify.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. First turn on Always Use HTTPS under SSL/TLS then Edge Certificates so http:// redirects to https://, and check the site works over HTTPS.
2. For a short test period, use a response header rule. Open Rules then Overview, choose Create rule then Response Header Transform Rule, set the filter to the hostname, choose Set static, header name Strict-Transport-Security and value max-age=300.
3. Check with curl -sI that the header is sent, then raise the value in the stages from the generic steps.
4. When you are ready for the long-term setting, delete the rule and use the built-in setting under SSL/TLS then Edge Certificates then HSTS. It offers max-age values of one month and up, plus the includeSubDomains and preload options. Never run both at once.
5. Keep HTTPS working while HSTS is on. Do not set records to DNS only, pause Cloudflare or turn off SSL, or visitors will be locked out until max-age ends.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list