Verify HTTPS is Working Properly

Before enabling HSTS, ensure your site is fully HTTPS-ready:

# Check SSL certificate
curl -vI https://yoursite.com 2>&1 | grep -A 6 "Server certificate"

# Check for mixed content (HTTP resources on HTTPS page)
# Open Chrome DevTools > Console > Look for "Mixed Content" warnings

# Verify redirect is in place
curl -I http://yoursite.com
# Should return 301/302 redirect to https://

Start with a Short max-age for Testing

Add HSTS with a 5-minute max-age to test safely:

nginx:

server {
    listen 443 ssl http2;
    server_name yoursite.com;

    # HSTS - Start with short max-age for testing
    add_header Strict-Transport-Security "max-age=300" always;

    # ... rest of config
}

Apache:

<VirtualHost *:443>
    ServerName yoursite.com

    # HSTS - Start with short max-age for testing
    Header always set Strict-Transport-Security "max-age=300"

    # ... rest of config
</VirtualHost>

Express.js:

const helmet = require('helmet');

// HSTS with short max-age for testing
app.use(helmet.hsts({
  maxAge: 300, // 5 minutes
  includeSubDomains: false,
  preload: false
}));

Vercel (vercel.json):

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=300"
        }
      ]
    }
  ]
}

Netlify (_headers):

/*
  Strict-Transport-Security: max-age=300

Verify the Header is Being Sent

# Check HSTS header with curl
curl -I https://yoursite.com | grep -i strict-transport-security

# Expected output:
# strict-transport-security: max-age=300

Or check in browser DevTools:

1. Open DevTools (F12)
2. Go to Network tab
3. Reload the page
4. Click on the document request
5. Find strict-transport-security in Response Headers

Test HSTS Behavior

Verify browsers redirect HTTP to HTTPS without contacting your server:

1. Visit your site via HTTPS to receive the HSTS header
2. Type http://yoursite.com in the address bar
3. The browser should redirect to HTTPS immediately (internal redirect)
4. Check Network tab - you should see a "307 Internal Redirect"

Check HSTS status in Chrome:

# Visit this URL in Chrome
chrome://net-internals/#hsts

# Query your domain to see HSTS status
# Delete the entry if you need to reset during testing

Increase max-age for Production

Once verified, increase to 1 year (required for preload list):

nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Express.js:

app.use(helmet.hsts({
  maxAge: 31536000, // 1 year
  includeSubDomains: true,
  preload: false // Don't add preload yet
}));

Vercel:

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains"
        }
      ]
    }
  ]
}

Netlify:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Submit to HSTS Preload List (Optional)

For maximum security, submit your domain to the browser preload list:

Requirements for preload:

• Serve a valid SSL certificate
• Redirect all HTTP to HTTPS on the same host
• All subdomains must support HTTPS
• HSTS header with: max-age of at least 1 year (31536000)
• HSTS header with: includeSubDomains directive
• HSTS header with: preload directive

Update your HSTS header for preload:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Submit at: hstspreload.org