Skip to content
FixSecurityHeadersScan a site

How to add Strict-Transport-Security on Netlify

Last updated · Reviewed by a CISSP-certified security practitioner

To add Strict-Transport-Security on Netlify, set the header in _headers (in publish directory) with the value max-age=63072000; includeSubDomains; preload. Forces browsers to only use HTTPS for your domain. Redeploy; check Deploy summary → Headers rules processed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Strict-Transport-Security do?

HSTS tells the browser to always connect over HTTPS for a set time, even if someone types http:// or clicks an old link.

Risk if missing: Without it, the first request can be downgraded to plain HTTP, letting attackers on public Wi‑Fi intercept or rewrite traffic (SSL stripping).

What is the Netlify configuration?

Add this to _headers (in publish directory):

_headers (in publish directory)
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

How do I add it step by step?

  1. Open _headers (in publish directory).
  2. Paste the Strict-Transport-Security configuration shown below.
  3. Redeploy; check Deploy summary → Headers rules processed.
  4. Run curl -I https://yourdomain.com and look for the strict-transport-security line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "strict-transport-security"
# expected:
# strict-transport-security: max-age=63072000; includeSubDomains; preload

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • The preload directive is hard to undo: removal from browser preload lists takes months.
  • includeSubDomains breaks any subdomain that still serves plain HTTP. Audit subdomains first.
  • Start with a short max-age (e.g. 300) and ramp up to 1–2 years once verified.
  • Browsers ignore HSTS sent over plain HTTP; it must be sent on the HTTPS response.
  • The _headers file must end up in your publish directory (e.g. public/).
  • Indent header lines under the path pattern.

Quick reference

HeaderStrict-Transport-Security
Recommended valuemax-age=63072000; includeSubDomains; preload
StackNetlify
Where_headers (in publish directory)
CompliancePCI DSS 4.0 4.2.1, NIST 800-171 3.13.8, CMMC SC.L2-3.13.8, OWASP ASVS V14.4.5, SOC 2 CC6.7

FAQ

What value should I use for Strict-Transport-Security?

A safe default is max-age=63072000; includeSubDomains; preload. The preload directive is hard to undo: removal from browser preload lists takes months.

Why isn't Strict-Transport-Security showing up on Netlify?

The _headers file must end up in your publish directory (e.g. public/). Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Strict-Transport-Security affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Strict-Transport-Security?

PCI DSS 4.0 4.2.1, NIST 800-171 3.13.8, CMMC SC.L2-3.13.8, OWASP ASVS V14.4.5, SOC 2 CC6.7.

Related guides