# Ensure HSTS is enabled with recommended max-age and includes subdomains

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787220114756-ensure-hsts-is-enabled-with-recommended-max-age-and-includes-subdomains
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure HTTP Strict Transport Security (HSTS) is enabled for the zone, with a Max Age of at least 6 months and Apply HSTS policy to subdomains (includeSubDomains) turned on. This tells browsers to always use HTTPS for the domain and its subdomains.

**Rationale**

Even with redirects, a visitor's first HTTP request can be intercepted and downgraded by an attacker. HSTS tells browsers to connect only over HTTPS for the set period, preventing downgrade attacks and cookie theft. Including subdomains closes gaps on hostnames that could otherwise be attacked.

**Impact**

-   Browsers always use HTTPS for the domain and subdomains
    
-   Prevents protocol downgrade attacks
    
-   Every subdomain must support HTTPS, or it will become unreachable in browsers for the Max Age period
    

**Default Value**

By default, HSTS is not enabled.

**Pre-Requisites**

-   Cloudflare account with Administrator or SSL/TLS permissions for the zone
    
-   All subdomains serving valid HTTPS
    
-   Always Use HTTPS turned on
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  In the HTTP Strict Transport Security (HSTS) section, check whether HSTS is enabled.
    
5.  Verify that Max Age is at least 6 months and Apply HSTS policy to subdomains is on.
    
6.  If not, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  For HTTP Strict Transport Security (HSTS), select Enable HSTS.
    
5.  Read the dialog, select I understand, and select Next.
    
6.  Turn on Enable HSTS, set Max Age Header to 6 months or more, and turn on Apply HSTS policy to subdomains.
    
7.  Optionally turn on No-Sniff Header, and select Save.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  For HTTP Strict Transport Security (HSTS), select Enable HSTS (or Change HSTS Settings).
    
5.  Set Max Age Header to 0 (Disable) and select Save. Browsers that already saw the header keep enforcing HTTPS until the previous Max Age expires.
    

**Reference**

-   [https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.