HTTP Strict-Transport-Security (HSTS)

HSTS stands for HTTP Strict Trans­port Secu­ri­ty. It is a hea­der spe­ci­fi­ca­ti­on that tells the brow­ser of the page visi­tor that for a spe­ci­fied peri­od of time (max-age), com­mu­ni­ca­ti­on should take place exclu­si­ve­ly via a secu­re con­nec­tion (HTTPS).

How to enable the HSTS header on Plesk for Linux #

1. Sign in to Plesk.
2. Go to Web­sites & Domains > Hos­ting Set­tings and enable the “Per­ma­nent SEO-safe 301 redi­rect from HTTP to HTTPS” opti­on the­re.
3. Then go to Web­sites & Domains > Apa­che & nginx set­tings.
4. Now enter the fol­lo­wing the­re and save the chan­ges after­wards.
   1. Apa­che, addi­tio­nal ins­truc­tions for HTTPS:
      add_header Hea­der always set Strict-Tran­s­­port-Secu­ri­­ty “max-age=31536000”
   2. Addi­tio­nal nginx direc­ti­ves:
      add_header Strict-Tran­s­­port-Secu­ri­­ty “max-age=31536000” always;

That was it alre­a­dy. You have acti­va­ted the HSTS hea­der for your domain.