What is HSTS and should I enable it?

HSTS (HTTP Strict Transport Security) is a security header that tells browsers to only ever connect to your site over HTTPS, even if someone types http:// or clicks an old insecure link. It closes a small window where a visitor's first request could be intercepted.

It is a strong security measure, but enable it carefully:

• Only turn on HSTS once your SSL certificate is valid and your whole site already works properly over HTTPS.
• Once a browser has seen the header, it will refuse plain HTTP for the duration you set, so if HTTPS ever breaks, visitors cannot fall back.

To enable it, add this to your .htaccess file:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Start with a shorter max-age (for example a few hours) while testing, then increase it to a year once you are confident.

Only add preload and submit to the browser preload list if you are certain every subdomain will always use HTTPS, because it is hard to reverse. If you would like us to configure HSTS safely for you, contact WhatsApp +971 58 553 6767 or support@dirhamaday.ae.