Description

Ensure HTTP Strict Transport Security (HSTS) is enabled for the zone, with a Max Age of at least 6 months and Apply HSTS policy to subdomains (includeSubDomains) turned on. This tells browsers to always use HTTPS for the domain and its subdomains.

Rationale

Even with redirects, a visitor's first HTTP request can be intercepted and downgraded by an attacker. HSTS tells browsers to connect only over HTTPS for the set period, preventing downgrade attacks and cookie theft. Including subdomains closes gaps on hostnames that could otherwise be attacked.

Impact

  • Browsers always use HTTPS for the domain and subdomains

  • Prevents protocol downgrade attacks

  • Every subdomain must support HTTPS, or it will become unreachable in browsers for the Max Age period

Default Value

By default, HSTS is not enabled.

Pre-Requisites

  • Cloudflare account with Administrator or SSL/TLS permissions for the zone

  • All subdomains serving valid HTTPS

  • Always Use HTTPS turned on

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. In the HTTP Strict Transport Security (HSTS) section, check whether HSTS is enabled.

  5. Verify that Max Age is at least 6 months and Apply HSTS policy to subdomains is on.

  6. If not, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. For HTTP Strict Transport Security (HSTS), select Enable HSTS.

  5. Read the dialog, select I understand, and select Next.

  6. Turn on Enable HSTS, set Max Age Header to 6 months or more, and turn on Apply HSTS policy to subdomains.

  7. Optionally turn on No-Sniff Header, and select Save.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. For HTTP Strict Transport Security (HSTS), select Enable HSTS (or Change HSTS Settings).

  5. Set Max Age Header to 0 (Disable) and select Save. Browsers that already saw the header keep enforcing HTTPS until the previous Max Age expires.

Reference