How to Force HTTPS (HSTS) in HestiaCP

Prerequisites

Before enabling HSTS, make sure you have:

• A valid SSL certificate installed
• SSH access to your VPS

What is HSTS?

HTTP Strict Transport Security forces browsers to only connect via HTTPS, preventing SSL stripping attacks.

Enable HSTS via HestiaCP Web Interface

Step 1: Log in to HestiaCP

https://YOUR_SERVER_IP:8083

Step 2: Navigate to WEB Section

Click on your domain → SSL tab.

Step 3: Enable HSTS

Toggle HSTS switch to ON.

Set Max Age (seconds):

• 31536000 (1 year) - Recommended for production
• 2592000 (30 days) - For testing

Optional: Enable Include Subdomains to apply HSTS to all subdomains.

Step 4: Save

Click Save to apply.

Enable HSTS via Nginx Configuration (Manual)

Edit Nginx domain config:

nano /home/admin/conf/web/nginx.example.com.conf

Add inside server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Restart Nginx:

systemctl restart nginx

Enable HSTS in Apache (.htaccess)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

HSTS Preload List Submission

To get your domain added to browser preload lists:

1. Enable HSTS with includeSubDomains and preload directive
2. Submit domain at: https://hstspreload.org
3. After approval, your site will always be HTTPS-only

Verify HSTS is Working

curl -I https://example.com | grep -i strict

Expected output:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Disable HSTS

Remove the HSTS header from config and restart web server.