Send HSTS on the redirect visitors meet first on Cloudflare

Why it matters

Visitors who type this name get a redirect first, to the host the site is served from or to another page of the same host. Without a Strict-Transport-Security header on that redirect, a visitor whose policy has expired can still be downgraded there, and the HSTS preload list reads the header on it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. When Cloudflare answers the redirect (a redirect rule or page rule), turn on HSTS under SSL/TLS then Edge Certificates then HSTS. It applies to every proxied hostname of the zone, including example.com.
2. If the redirect comes from your origin instead, add the header there as in the generic steps, or with a response header transform rule filtered on the hostname example.com.

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list