By default, all websites hosted on Staq have HSTS (HTTP Strict Transport Security) enforced. This is achieved at the NGINX server level through the response header:<\/p>\n
HSTS ensures that all communication between the website and its visitors occurs over HTTPS, enhancing security by preventing protocol downgrade attacks and man-in-the-middle attacks.<\/p>\n HSTS enforcement on Staq automatically applies to both HTTP and HTTPS connections. Any HTTP requests are redirected to HTTPS, ensuring secure access at all times.<\/p>\n If you are using Cloudflare, you might notice an option to enable HSTS under:<\/p>\n While Cloudflare allows enabling HSTS, this is not required<\/strong> when your site is hosted on Staq. Here\u2019s why:<\/p>\n There is no need to enable HSTS via Cloudflare when using Staq, as it is already enforced by default at the server level. Enabling it in Cloudflare would have no additional benefit and is redundant.<\/p>\n","protected":false},"featured_media":0,"parent":0,"template":"","class_list":["post-37049","knowledgebase","type-knowledgebase","status-publish","hentry","categories-security"],"acf":[],"yoast_head":"\nstrict-transport-security<\/code><\/strong><\/p>\nWhat is HSTS?<\/h3>\n
How HSTS is Enforced on Staq<\/h3>\n
Using Cloudflare with Staq<\/h3>\n
\n
\n
strict-transport-security<\/code> response header appears even when\u00a0Cf-Cache-Status<\/strong> is set to HIT<\/li>\nstrict-transport-security<\/code> response header when configured.<\/li>\n<\/ul>\nSummary<\/h3>\n