Enable HSTS gradually

HSTS tells the browser that, for the configured time, it must return to that name only over HTTPS. The browser learns this when it receives the header over a valid HTTPS connection; a header sent over HTTP is ignored.

Do not enable it just to pass an audit. First confirm that:

• The domain presents a valid, renewable certificate.
• The whole site, including login, payments, APIs and resources, works over HTTPS.
• There is a stable redirect from HTTP to HTTPS.
• You can keep HTTPS working for the whole max-age, because visitors will not be able to bypass a later failure.

You can then add a short initial policy, sent only over HTTPS, to the domain's .htaccess file:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=300" "expr=%{HTTPS} == 'on'"
</IfModule>

Test the website and increase the value gradually, for example to one day and then to several months. Do not add includeSubDomains until you have confirmed that every current and future subdomain will always work over HTTPS. Do not add preload by default: removing it can take a long time and requires meeting the preload list's requirements.

HSTS does not fix mixed content, an invalid certificate or an incorrect redirect. Solve those problems before extending the policy.

Check and remove the policy

In the browser's developer tools, open Network, load the HTTPS URL and inspect the document's response headers. A single Strict-Transport-Security policy with the chosen value should appear. Also check pages that redirect or return an error. Behind a proxy, confirm where TLS terminates and set the header at the layer that reliably knows the visitor's protocol; do not trust a header the client can send freely.

The rule above uses Apache 2.4 expressions. If the server does not support it or returns a 500 error, restore the previous .htaccess and contact us before adapting the condition.

Removing the line does not erase what browsers have already learnt. To withdraw a normal policy, serve max-age=0 over valid HTTPS; visitors who do not come back will keep the policy until it expires. A parent domain's policy with includeSubDomains and preloading need a separate review. See the preload list requirements and removal before applying for it.