HSTS
The HTTP Strict Transport Security (HSTS) plug-in instructs browsers to use only HTTPS when communicating with your server, preventing unencrypted HTTP connections.
Plug-in type
Throttling plug-in.
Description
The HSTS plug-in instructs browsers to communicate with the server over HTTPS only for a specified duration. Unlike forced HTTPS redirection, HSTS triggers a 307 internal redirect in the browser, converting HTTP requests to HTTPS without additional network round-trips.
How it works
The HSTS plug-in adds the strict-transport-security header to all HTTPS responses with the following fields:
-
max_age: duration in seconds that the browser enforces HTTPS-only access. -
include_sub_domains: whether to enforce HTTPS for the current domain and all subdomains.
Fields
|
Field |
Data type |
Required |
Default value |
Description |
|
max_age |
number |
No |
15724800 |
Duration in seconds that the browser enforces HTTPS-only access. |
|
include_sub_domains |
bool |
No |
false |
Whether to enforce HTTPS for the current domain and all subdomains. |
If include_sub_domains is set to true, the current domain and all its subdomains enforce HTTPS-only access. Make sure all subdomains support HTTPS before you enable this option. Otherwise, users cannot access subdomains that do not have HTTPS configured.