How to Enable HSTS (HTTP Strict Transport Security) on Your Website

HSTS (HTTP Strict Transport Security) is a setting that tells a visitor's browser "always load this website over HTTPS, never over plain HTTP, from now on." Once it's active, even if someone types your address without https:// or clicks an old http link, the browser rewrites the request to HTTPS before it ever leaves their device. This closes a small but real security gap: without HSTS, that first request can travel over an unencrypted connection for a split second, which is enough for it to be intercepted on an unsafe network.

What HSTS Does

Normally, your website redirects http traffic to https using a server-side redirect. That works, but the first request still touches your server in plain HTTP form before the redirect kicks in. HSTS moves that decision into the browser itself. Once a browser has seen your HSTS header once, it will refuse to connect over HTTP at all for the length of time you specify, and will automatically use HTTPS instead.

Only enable HSTS once your website works correctly and reliably over HTTPS. If you turn it on and your SSL certificate later expires or breaks, visitors' browsers will refuse to load your site at all until it's fixed, since they won't fall back to HTTP.

Before You Turn It On

• Confirm your SSL certificate is installed and valid, and that https:// works correctly on every page of your website.
• Make sure you already have a working HTTP-to-HTTPS redirect in place.
• Start with a short duration (a few hours or a day) while you test, then increase it once you're confident everything works.

How to Enable HSTS

HSTS is turned on by adding one line to your website's .htaccess file. The rule itself is identical in cPanel and DirectAdmin; only the way you get to File Manager differs slightly.

In cPanel

1. Log in to cPanel and open File Manager.
2. Navigate to your website's root folder (usually public_html, or the specific folder for an addon domain).
3. Make sure hidden files are visible: click Settings in the top-right corner of File Manager and enable Show Hidden Files.
4. Right-click .htaccess and select Edit. If the file doesn't exist yet, create a new file named .htaccess.
5. Add the following line near the top of the file, then click Save Changes:

Header always set Strict-Transport-Security "max-age=86400"

In DirectAdmin

1. Log in to DirectAdmin and open File Manager.
2. Go into your domains folder, then the folder for the specific domain, then public_html.
3. Enable the option to show hidden files if .htaccess isn't visible.
4. Open .htaccess for editing (or create it if it doesn't exist).
5. Add the same line shown above and save the file.

The max-age value is how long, in seconds, a browser should remember to force HTTPS for your domain. 86400 is one day, good for initial testing. Once you're confident HTTPS is stable, increase it to something like 31536000 (one year), which is the standard long-term value.

Testing That It's Working

1. Open your website in a browser and check the page loads normally over https://.
2. Open your browser's developer tools, go to the Network tab, reload the page, and check the response headers for your domain's main request. You should see a strict-transport-security header with the value you set.
3. Try visiting your site again using a plain http:// link. Once the browser has stored the header, it should rewrite the request to https automatically, without a visible redirect.

If Something Goes Wrong

Because HSTS is remembered by the browser itself, simply removing the header from your .htaccess file won't undo it right away for visitors who already loaded your site. Their browser will keep forcing HTTPS until the max-age you originally set expires. This is exactly why it's worth starting with a short duration and increasing it gradually, rather than jumping straight to one year.

If your certificate does lapse while HSTS is active, fix the certificate rather than trying to disable HSTS. Visitors' browsers won't accept an HTTP fallback in the meantime.

If you haven't set up a basic HTTPS redirect yet, start with How to Force HTTPS and Redirect All Traffic to Your Secure Website before adding HSTS on top of it.