Skip to content
Pricing RU Sign In
RU

How to Enable HSTS on nginx and Apache

By · Updated
TL;DR:

To enable HSTS: add the header Strict-Transport-Security: max-age=31536000; includeSubDomains; preload in nginx (add_header) or Apache (Header set). For hstspreload.org inclusion — all subdomains must also serve HSTS and HTTPS.

Try it now — free →

Step-by-step guide

  1. Check current HSTS. Open /en/security, enter domain. Grade < A often means missing or wrong HSTS.
  2. nginx — add header. In the 443 server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  3. Apache — via mod_headers. Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  4. Check all subdomains. If you have www, api, status, blog — each must serve HSTS. Otherwise preload submission will fail.
  5. Submit to hstspreload.org. Fill the form at hstspreload.org. Review takes 1-2 months. Then you land in Chrome's built-in list.

Open tool →

Related guides

HeadersCSP, HSTS, X-Frame-Options, etc.
SSL/TLSEncryption and certificate
ConfigurationServer settings and leaks
Grade A-FOverall security score

Why teams trust us

OWASP
guidelines
15+
security headers
<2s
result
A–F
security grade

How it works

1

Enter site URL

2

Security headers analyzed

3

Get grade A–F

What Does the Security Analysis Check?

The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.

Header Analysis

Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.

SSL Check

TLS version, certificate expiry, chain of trust, HSTS support.

Leak Detection

Finding exposed server versions, debug modes, open configs, and directories.

Report with Recommendations

Detailed report explaining each issue with specific steps to fix it.

Who uses this

Security teams

HTTP header audit

DevOps

config verification

Developers

CSP & HSTS setup

Auditors

compliance checks

Common Mistakes

❌
Missing Content-Security-PolicyCSP is the primary XSS defense. Without it, script injection is much easier.
❌
Missing HSTS headerWithout HSTS, HTTPS-to-HTTP downgrade attacks are possible. Enable Strict-Transport-Security.
❌
Server header exposes versionServer: Apache/2.4.52 helps attackers find exploits. Hide the version.
❌
X-Frame-Options not setSite can be embedded in iframe for clickjacking. Set DENY or SAMEORIGIN.
❌
Missing X-Content-Type-OptionsWithout nosniff, browsers may misinterpret file types (MIME sniffing).

Best Practices

✓
Start with basic headersMinimum: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Takes 5 minutes.
✓
Implement CSP graduallyStart with Content-Security-Policy-Report-Only, monitor violations, then enforce.
✓
Hide server headersRemove Server, X-Powered-By, X-AspNet-Version from responses.
✓
Configure Permissions-PolicyRestrict camera, microphone, geolocation access — only what is actually used.
✓
Check after every deploySecurity headers can be overwritten during server configuration updates.

Get more with a free account

Security check history and HTTP security header monitoring.

Sign up free

Related tools

SSL CheckPageSpeedMixed ContentHealth Score

Learn more

How-to

Glossary

Research

Alternatives

Frequently Asked Questions

Signup required?

No for quick check. For continuous monitoring — free account.

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation