HTTP Strict-Transport-Security (HSTS)

HSTS stands for HTTP Strict Transport Security. It is a header specification that tells the browser of the page visitor that for a specified period of time (max-age), communication should take place exclusively via a secure connection (HTTPS).

How to enable the HSTS header on Plesk for Linux #

1. Sign in to Plesk.
2. Go to Websites & Domains > Hosting Settings and enable the “Permanent SEO-safe 301 redirect from HTTP to HTTPS” option there.
3. Then go to Websites & Domains > Apache & nginx settings.
4. Now enter the following there and save the changes afterwards.
   1. Apache, additional instructions for HTTPS:
      add_header Header always set Strict-Transport-Security “max-age=31536000”
   2. Additional nginx directives:
      add_header Strict-Transport-Security “max-age=31536000” always;

That was it already. You have activated the HSTS header for your domain.