Add the Strict-Transport-Security (HSTS) header on Squarespace
Why it matters
Without HSTS, a browser that is sent to the http:// address first can be intercepted before it reaches the secure site. The header tells browsers to use HTTPS only, for as long as you specify.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- In your Squarespace site, open Settings then Domains (older sites: Settings then Advanced) and find the SSL options, or type SSL into the settings search.
- Choose HSTS Secure, which makes Squarespace send the Strict-Transport-Security header, and save. Squarespace sets the max-age itself.
Related
- Reported by the HSTS check
- Fix the malformed Strict-Transport-Security header
- Re-enable HSTS (max-age is zero)
- Raise the HSTS max-age
- Decide whether to add includeSubDomains
- Meet the HSTS preload requirements or remove preload
- Consider submitting the domain to the HSTS preload list
- Send HSTS on the redirect visitors meet first
Scan your domain to see whether this applies to you.