Security · NinjaOps Guides

HSTS: One Header That Locks HTTPS On

Strict-Transport-Security tells browsers to never speak plain HTTP to your domain again — even on a typo'd http:// link. It closes downgrade attacks and secures every subdomain with one line.

How to fix it

  1. Send Strict-Transport-Security: max-age=15552000; includeSubDomains.
  2. Start with a short max-age (a day), raise once confident.
  3. Cloudflare: Edge → add HSTS response header, or set in zone TLS settings.
  4. Remember it's sticky: browsers remember even after you remove it.
Strict-Transport-Security: max-age=15552000; includeSubDomains

Diagnose this exact issue on your site — free

The 100-Point Affiliate Site Grader runs this check (and 40+ more) on your live site in ~10 seconds. No signup.

Want it fixed for you?

The Zero-Overhead Affiliate Playbook walks through every gap in this guide in 14 days on a $0 stack. Join the launch list →

More Security fixes: