How to Configure HTTP Strict Transport Security (HSTS) with Apache

This brief tutorial shows students and new users how to configure HTTP Strict Transport Security (HSTS) with Apache on Ubuntu Linux.

If you’re using HTTPS or going to use it on your websites, then HSTS is something you might want to configure.

HTTP Strict Transport Security (HSTS) is a security policy that helps protect against downgrade attacks and cookies hijacking. When configured, your web server enforces strict HTTPS connection for web browsers and never via the insecure HTTP protocol.

To enhance connections to your Apache web server, ensure that HSTS is also enabled to help protect against a man-in-the-middle attack.

This should work across most systems since newer web browsers enable HSTS. When a web browser contacts an HSTS-enabled server, the browser, by default, looks for a special HTTP header related to HSTS.

If the special header is enabled, the web server instructs the browser to only communicate over HTTPS. When the web browser receives the instruction from the header, the following connection after that will always be HTTPS and never HTTP.

This ensures the connection between the web server and the web browser is protected.

How to enable the Apache headers module

To use HSTS with Apache, you’ll want to enable the Apache headers module. To do that, run the command below:

sudo a2enmod headers

How to enable HSTS with Apache

After enabling the headers module for Apache, look at the VirtualHost file for your website and add the line below.

The line should be placed between the <VirtualHost *:443> and </VirtualHost>

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

An example VirtualHost file with HSTS enabled should look similar to the one below.

<VirtualHost *:443>
       # The ServerName directive sets the request scheme, hostname and port
       # the server uses to identify itself. This is used when creating
       # redirection URLs. In the context of virtual hosts, the ServerName
       # specifies what hostname must appear in the request's Host: header to
       # match this virtual host. For the default virtual host (this file) this
       # value is not decisive as it is used as a last resort host regardless.
       # However, you must set it for any further virtual host explicitly.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

</VirtualHost>

Because you enabled HTST in Apache, you’ll also want to redirect all connections over HTTPS. To do that, open the Apache default SSL configuration file.

The default SSL file on the Ubuntu system is at /etc/apache2/sites-enabled/000-default-ssl.conf

Redirect all traffic on HTTP to HTTPS. This is a must if you want HSTS to function correctly with Apache.

Open the Apache default SSL configuration file, add the code block in that config file, and save.

sudo nano /etc/apache2/sites-enabled/000-default-ssl.conf

Add the highlighted lines and save.

<VirtulHost *:80>  
.....  
       RewriteEngine on
       RewriteCond %{SERVER_NAME} =www.example.com [OR]
       RewriteCond %{SERVER_NAME} =example.com
       RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
.....

 </VirtualHost>

Once you’re done, restart Apache.

sudo systemctl restart apache2

That should do it!

Conclusion:

This post showed you how to enable HSTS with Apache in Ubuntu.

Please use the comment form below if you find any errors above or have something to add.