Staq enforces HSTS by default

By default, all websites hosted on Staq have HSTS (HTTP Strict Transport Security) enforced. This is achieved at the NGINX server level through the response header:

strict-transport-security

What is HSTS?

HSTS ensures that all communication between the website and its visitors occurs over HTTPS, enhancing security by preventing protocol downgrade attacks and man-in-the-middle attacks.

How HSTS is Enforced on Staq

HSTS enforcement on Staq automatically applies to both HTTP and HTTPS connections. Any HTTP requests are redirected to HTTPS, ensuring secure access at all times.

Using Cloudflare with Staq

If you are using Cloudflare, you might notice an option to enable HSTS under:

• SSL/TLS > Edge Certificates > Enable HSTS

While Cloudflare allows enabling HSTS, this is not required when your site is hosted on Staq. Here’s why:

• Staq already enforces HSTS via the response header at the NGINX server level.
• Staq automatically sets caching rules via the Cloudflare account and the strict-transport-security response header appears even when Cf-Cache-Status is set to HIT
• Cloudflare also delivers cached files with their own strict-transport-security response header when configured.

Summary

There is no need to enable HSTS via Cloudflare when using Staq, as it is already enforced by default at the server level. Enabling it in Cloudflare would have no additional benefit and is redundant.