How to Set Up HSTS

Step 1: Ensure SSL is Working

Your website must be accessible via HTTPS.

Step 2: Add HSTS Header in Nginx

sudo nano /etc/nginx/sites-available/example.com

Inside server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Step 3: For Apache

sudo nano /etc/apache2/conf-available/security.conf

Add:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Step 4: Test HSTS

curl -I https://example.com | grep -i strict