> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.xynta.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Enabling HSTS

**HSTS** stands for **HTTP Strict Transport Security**. It is a security measure that ensures visitors can only communicate with your website via a secure connection ( **HTTPS**). HSTS prevents vulnerabilities such as **man-in-the-middle attacks**, guaranteeing that the communication between the user and your website remains secure.

* [Implementing HSTS](#3-implementing-hsts)
* [Key Considerations](#3-key-considerations)
* [HSTS Preload List](#3-hsts-preload-list)
---

### Implementing HSTS

Follow these steps to easily implement HSTS:

1. **Ensure a valid SSL certificate:**
   Your website must fully function over HTTPS.

2. **Edit the .htaccess file:**
   
* Open the `.htaccess` file in your website’s root directory (e.g., `domains/voorbeeld.cc/public_html`).
* If no `.htaccess` file exists, create one.
* Add the following line:
     
```
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
```
  
* **Explanation:**
     
* `max-age=31536000`: browsers will enforce HTTPS for 1 year.
* `includeSubDomains`: also applies to all subdomains.
* `preload`: optional, for inclusion in the HSTS Preload List.

3. **Save and close the file.**
4. **Test your website:**
   Verify everything works correctly, and use tools like [SSL Labs SSL Test](https://www.ssllabs.com/ssltest/) to validate your setup.

❗ **Important:** Only implement HSTS if your site will consistently support HTTPS.
---

### Key Considerations

* **SSL certificate required:** Your website must operate fully over HTTPS.
* **Test on a subdomain first:** To reduce potential risks.
* **Use a cautious max-age initially:** Start with a short duration (e.g., 300 seconds).
* **Be careful with includeSubDomains:** Ensure all subdomains support HTTPS.
* **Delay using preload:** Preloading is difficult to undo once active.
* **Ensure all external resources load via HTTPS.**
* **Monitor your website carefully after activation.**
* **Document your changes** for easy reference.
---

### HSTS Preload List

The **HSTS Preload List** is maintained by browsers like Chrome, Firefox, and Safari to enforce HTTPS-only access for certain domains.

**Benefits:**

* Enhanced security: protects against network and man-in-the-middle attacks.
* Faster connections: eliminates the initial HTTP request.

**When to submit:**

* Only after thorough testing and 100% HTTPS compatibility.
* Only if you intend to permanently use HTTPS.

👉 More info and submission: [hstspreload.org](https://hstspreload.org)