> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/performance-cdn/static-content-delivery/advanced-configuration/headers/http-strict-transport-hsts-protection.md).

# HTTP Strict Transport (HSTS) Protection

Learn how HSTS Protection enforces HTTPS-only access for your CDN Resource.

**HTTP Strict Transport Security (HSTS)** instructs browsers to access your domain over HTTPS for a specified period. When enabled, the CDN adds the `Strict-Transport-Security` header to HTTPS responses.

HSTS can also extend HTTPS enforcement to subdomains and include the `preload` directive for domains intended for browser preload lists.

You can configure HSTS in the [Medianova Control Panel](https://cloud.medianova.com) or via the [API](https://clients.medianova.com/api-documentation/performance-cdn/headers#put-api-v1-cdn-organization_uuid-resource-resource_uuid-4).

{% hint style="warning" %}
Enable HSTS only after confirming that your domain is fully accessible over HTTPS. Before enabling **Include subdomains**, ensure that all subdomains support HTTPS.
{% endhint %}

## Configure HSTS

{% stepper %}
{% step %}

### Open HSTS

Open your CDN Resource and select **Headers**.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FGSIqwNHMlHFqdk1e7u4Z%2Fimage.png?alt=media&amp;token=58ca46cb-1fc3-40c8-8d56-f6756f9755ea" alt=""><figcaption></figcaption></figure>

Locate the **HSTS** section.
{% endstep %}

{% step %}

### Enable HSTS

Enable **HSTS**.
{% endstep %}

{% step %}

### Set Max Age

Enter the **Max age** in seconds.

This value determines how long browsers cache the HSTS policy and enforce HTTPS for the domain.

Common values include:

* `31536000` — 1 year
* `63072000` — 2 years

For example, a Max age of `31536000` produces:

```http
Strict-Transport-Security: max-age=31536000
```

{% endstep %}

{% step %}

### Include Subdomains

Enable **Include subdomains** to apply the HSTS policy to every subdomain.

When enabled, the response header includes the `includeSubDomains` directive:

```http
Strict-Transport-Security: max-age=31536000; includeSubDomains
```

{% hint style="warning" %}
Enable this option only when all subdomains are available over HTTPS. Browsers that cache this policy will enforce HTTPS for the included subdomains.
{% endhint %}
{% endstep %}

{% step %}

### Configure Preload

Enable **Preload** to add the `preload` directive to the HSTS policy.

The Control Panel requires a **Max age** of at least `31536000` seconds and **Include subdomains** to be enabled when using Preload.

With both options enabled, the header can be returned as:

```http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

{% hint style="warning" %}
The `preload` directive does not by itself add a domain to browser preload lists. Preload list inclusion requires a separate submission to the HSTS preload list and should be used only when long-term HTTPS enforcement is intended.
{% endhint %}
{% endstep %}

{% step %}

### Save the Configuration

Click **Save** in the pending changes bar.

Review the pending changes and confirm the update.
{% endstep %}
{% endstepper %}

## How HSTS Works

When HSTS is enabled, the CDN adds the `Strict-Transport-Security` header to HTTPS responses. Browsers that receive the header cache the policy for the configured **Max age** and enforce HTTPS for subsequent connections during that period.

HSTS applies to HTTPS responses only. The `Strict-Transport-Security` header is not applied over HTTP connections.

{% hint style="info" %}
Changing or disabling HSTS does not immediately remove a policy already stored by a browser. The browser can continue enforcing the previously received policy until its cached `max-age` expires.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/performance-cdn/static-content-delivery/advanced-configuration/headers/http-strict-transport-hsts-protection.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.